Unfortunately this can be true! However, from my close dealings with the IC, they state it may be worth an investigation (assessment).(posted 7877 days ago)As acting as the processor the Bank/B.S is responsible for what data they handle. As your dealing with this matter is through HS&E, rather than their client, then as the IC have stated to me they should really pass over your SARN request.
Write back and state that they have to forward the SARN to the relevant parties, otherwise you will have to take the matter further.
BONUS POINTS!!! Any breach of the DPA 98, which causes you distress, can give you the opportunity to seek damages! Remind them the stress they are causing you and to resolve the SARN in whatever way ASAP!
Prehaps a way of claiming some of the money back?