DSAR- What are a banks obligations

[Matty B]

Hi
Sorry about the number of posts today- it is an admin day catching up with things

So I sent a DSAR to my ex bank, they replied with the usual stuff - statements etc but did not include emails I know that were sent and received. I have called them and they say they will send these out, what they are refusing to send out are things such as internal notes made after phone calls or in house bank communications about me.

I know something went on because they closed all my banking facilities but apart from being told 'it's something really serious' I do not know what. I know there is nothing on CIFAS and no adverse marks on my credit file. I have a current complaint with the FOS which has been rejected but I have bounced back to be looked at by the Ombudsman.

Is it worth sending a DSAR to National Hunter?

[R0b]

Hi

Has the bank given reasons why it is not disclosing the internal notes? If those internal notes are clearly about you and your data is being processed to create those notes, then they should be disclosable unless the bank is exempt under the Data Protection Act 2018. A Ccmmon exemption include notes or communications related to legal advice.

You might find the case of Lonsdale v Natwest a useful case to read (link here). A barrister issued proceedings for defamation against Natwest because they closed his business accounts down without notice and it turned out they issued a Suspicious Activity Report to the National Crime Agency for suspicion of money laundering or something like that (not to be confused with a Subject Access Request under the DPA).

Part of the issues determined by the court was whether these SARs were personal data and the conclusion that they may very well be personal data that is disclosable as part of a subject access request. The discusses and reviews all of the recent case law around subject access requests in coming to that conclusion. If your accounts are closed for something really serious, it's possible it might be something along these lines. Unsurprisingly, the bank settled with the barrister before a full hearing took place.

From a legal rights perspective, and I'm just summarising here:

- Article 15 of the UK GDPR (Right of Access) would require the bank to confirm, amongst other things, the categories of data being processed. Therefore they should confirm what categories of information they hold about you which should include internal notes and comments on their systems.

- Article 15 is also your right of access to that information which should be disclosed. I won't go into detail because the case mentioned above discusses and talks about what is meant by information relating to you etc. Except for any exemption, those notes should be disclosed to you as part of your personal data.

- Section 173 of the DPA 2018 makes it a criminal offence for any person to to alter, deface, block, erase, destroy or conceal information with the intention of preventing disclosure in accordance with your rights.

- Section 165 of the DPA 2018 allows you to make a formal complaint to the Information Commissioner for breach of your rights.

In terms of your next steps, it depends how you want to approach it. The FOS may not be the best adjudicator to make a decision and you may get a little further with the ICO instead. Just make it clear if you complain to the ICO that you specifically state your letter is made in accordance with Section 165 of the DPA 2018, otherwise you might get fobbed off.

I have seen similar complaints before and inevitably they end up going down the legal route after exhausting all other options. Some data controllers resist and defend proceedings but ultimately settle like the Londsdale case, others are quite happy to go all the way and take a risk. Just bear in mind, sometimes the people you are speaking to may not necessary have the full legal knowledge and training like a lawyer or an experience data protection officer so they are likely to just follow supervising instructions until the matter is escalated.

May be worth submitting a SAR to National Hunter and see what crops up but based on your description, your bank could have been closed for a number of reasons, whether it's suspicious activities on your account, bank dealings, money transfers or even associations with other people who may be considered suspicious or dangerous. Maybe those notes being withheld could hold the answers to your questions.

[Matty B]

Hi Rob
Thanks.
They claim internal comms relating to me are not personal data. Based on my (limited) data protection training I would disagree.

I strongly suspect it was because I had a complaint about my CC but obviously can’t prove it.

I have asked for the rest of the data but we will see.

ICO might be next and will definitely contact National Hunter just in case.

I have no financial dealings with anyone else, just lil ol me