Pastdue Credit Solutions - for debt I do not owe

[trover]

The Consumer Credit Act 1974 covers various types of borrowing i.e. credit cards, store cards, loans etc.
Section 88 is part of the CCA 1974 so is only going to apply to the agreements covered by the act i.e. credit cards, store cards, loans etc

A utility contract is a 'simple contract', it can be agreed over the phone, post or in person.

In your mum's case there wasn't a 'simple contract' as nothing had been agreed by your mum. They just set up an account and added a balance to it, because there was a debt outstanding on the account after missed payments, they applied a Default on the account. It will state in the Terms and Conditions what they would do if a payment is missed.

So your complaint is limited to the ICO.

Thank you for your explanation, that clears up my mind.

My mum has also received a response from UU. They argue that they had lawful basis to process her data, based on their “legitimate interests, public interest and legal obligation as a water and wastewater undertaker.”

[echat11]

It sounds like they have covered 'everything', but when companies do that, it generally means they don't know why they 'did that', it's a 'blanket' explanation. They didn't bother with 'due diligence'. I'd write back, make sure they know it's a complaint under the Data Protection Act 2018, highlight where they could have and should have checked to see who lived at 'XX XXXXXXXX Road, i.e. credit file etc. They have access to this information.

[PallasAthena]

My mum has also received a response from UU. They argue that they had lawful basis to process her data, based on their “legitimate interests, public interest and legal obligation as a water and wastewater undertaker.”

UU are yet again trying to bamboozle you with legal half-truths to cover up their wrongful use of data, in the hope it will discourage you from pursuing a data protection breach claim/complaint.

Yes it is true that UU may have the lawful basis of "legitimate interest, public interest and legal obligation" for processing personal data in general to identify who is liable to pay water bills for 'voids' but that doesn't give them the legal right to process the data of the wrong person - ie your mother - when they process it wrongly to the extent of raising bills against the wrong person, damaging their credit status, setting debt collectors on them etc.

Under the Data Protection Act 2018 there are six Principles of data processing and UU must comply with ALL of them. The ICO link below explains them clearly.

The UU response to your mother only offers their explanation of how they believe they have complied with Principle 1. They have ignored their failure to comply with Principle 4, that the data they 'process' must be accurate!

https://ico.org.uk/for-organisations...ng/principles/

I would be pursuing my complaint and claim for compensation based primarily on a serious breach of Principle 4 which has caused actual harm through the use by UU of inaccurate information etc.

[trover]

It sounds like they have covered 'everything', but when companies do that, it generally means they don't know why they 'did that', it's a 'blanket' explanation. They didn't bother with 'due diligence'. I'd write back, make sure they know it's a complaint under the Data Protection Act 2018, highlight where they could have and should have checked to see who lived at 'XX XXXXXXXX Road, i.e. credit file etc. They have access to this information.

They explained they did check from her credit file.

In your case the account had been opened as a result of credit activity showing in your name at this address.

Since the last known previous occupier moved out 27 July 2022 we have received no contact to advise us that the property was occupied. We have therefore regularly sent letters to the property requesting any occupier to notify us if they have moved in. Those letter were sent 12 August 2022. No responses were received.

Having taken those steps to verify occupation, we contacted Equifax, a credit reference agency, who advised us that there was credit activity in your name at the address. We therefore wrote a further letter addressed to the occupier on 02 September 2022 asking them to contact us and advising that a bill would be raised within 21 days if we did not receive a response. We received no response and so sent a further letter on 16 September 2022 advising of our intention to bill. Receiving no response we opened the account in your name based on the information from Equifax regarding credit activity at the address in your name.

However, is it justifiable that merely the existence (not verifiable whether it is the case, perhaps bank accounts were not updated in CRA’s data base?) of credit activity allow their implication to her living at the address? Maybe UU could have visited the address to verify?

[trover]

UU are yet again trying to bamboozle you with legal half-truths to cover up their wrongful use of data, in the hope it will discourage you from pursuing a data protection breach claim/complaint.

Yes it is true that UU may have the lawful basis of "legitimate interest, public interest and legal obligation" for processing personal data in general to identify who is liable to pay water bills for 'voids' but that doesn't give them the legal right to process the data of the wrong person - ie your mother - when they process it wrongly to the extent of raising bills against the wrong person, damaging their credit status, setting debt collectors on them etc.

In their previous responses, they also relied heavily on s. 143 and 144 of the WIA 1991, which gives them the right to set up accounts and charge people. However, I believe that is similar to your point; they could bill the occupier, but not the non-occupier or a random person. Despite the legislation being irrelevant, they would try to quote them anyway, in the hope that I would go away.

Under the Data Protection Act 2018 there are six Principles of data processing and UU must comply with ALL of them. The ICO link below explains them clearly.

The UU response to your mother only offers their explanation of how they believe they have complied with Principle 1. They have ignored their failure to comply with Principle 4, that the data they 'process' must be accurate!

https://ico.org.uk/for-organisations...ng/principles/

I would be pursuing my complaint and claim for compensation based primarily on a serious breach of Principle 4 which has caused actual harm through the use by UU of inaccurate information etc.

Thanks for the insight on their possible breach of Principle 4. I did a bit of research on what I believe they may have breached:

Article 5, Principles 1, 2, and 6
Article 6 (process data without lawful grounds)
Article 12 (failed to comply with SAR within a month)
Article 14 (failed to inform data subject)

I am wondering whether I should continue to do more research on this and draft a LBC (I will have to at some point anyway), or submit a complaint to the ICO first?

[echat11]

They explained they did check from her credit file.



However, is it justifiable that merely the existence (not verifiable whether it is the case) of credit activity allow their implication to her living at the address? Maybe UU could have visited the address to verify?

I wonder what the 'veracity' of the following two statements are, simply because the Credit Agency hasn't got the manpower to respond to such enquiries. UU can check, but they are implying that the Credit Agencies provided the details on request -

'we contacted Equifax, a credit reference agency, who advised us that there was credit activity in your name at the address.'

'Receiving no response we opened the account in your name based on the information from Equifax regarding credit activity at the address in your name.'

Instead of 'we contacted', I believe it should read, 'we looked' at Equifax Reference Agency.

Doing the following first strengths your case, the ICO can 'highlight' the issues,

'submit a complaint to the ICO first'.

[trover]

I wonder what the 'veracity' of the following two statements are, simply because the Credit Agency hasn't got the manpower to respond to such enquiries. UU can check, but they are implying that the Credit Agencies provided the details on request -

'we contacted Equifax, a credit reference agency, who advised us that there was credit activity in your name at the address.'

'Receiving no response we opened the account in your name based on the information from Equifax regarding credit activity at the address in your name.'

Instead of 'we contacted', I believe it should read, 'we looked' at Equifax Reference Agency.

Doing the following first strengths your case, the ICO can 'highlight' the issues,

'submit a complaint to the ICO first'.

Their actions and statements have been very dubious; taken together, they are frankly quite ridiculous. What’s worse is that it appears to be a common practice throughout their company, and they do not seem to find it unacceptable. There may be thousands, if not tens of thousands of similar cases occurring. If my mum had been alone, she wouldn’t have had access to the forum to seek help from all of you, let alone the ability to resolve it properly.

I have submitted a complaint to the ICO, which will take 16 weeks for them to process.

In the meantime, I am preparing to submit a complaint to the CCW. However, I struggle to find a copy of their complaint handling procedures. I am wondering if they have a clause that prevents them from handling a complaint that has been dealt with by another ADR or organisation (although the ICO is not an ADR)?