Since serving the DPA Subject Access Rights Notice on the Halifax as mentioned in my posting "The HALIFAX - DPA Subject Access Rights" I have now received a Pre-printed form from them.

This form requires me to tick boxes on which type of information I require. i.e. Mortgage, Current Account etc. Whereas I am entitled under section 7(1) of the 1998 Data Protection Act. to any data held.

My major concern with this form is that I believe the Halifax are using it so that the data subject (myself) implicitly limits the information that the Halifax has to supply to within parameters that the Halifax themselves have defined for their own purposes. For instance there is no box to tick regarding the data that they may hold on me under complaints, debt tracing and collection, trading in personal information etc. The Halifax had already received from me the correct request for disclosure as specified within the act, so this form is NOT required!

I believe, by using this form, that the Halifax, may be deliberately deceiving the data subject into limiting the rights expressly granted to him/her by the Data Protection Act (1998). I will therefore be sending a formal complaint to the Data Protection Commissioner to that effect.

This form has obviously confirmed my concerns as to whether I would be able to see all the data that is held by the Halifax regarding myself.

So in the small "Other" portion of the form where they suggest Roll No. etc. I have in fact detailed the request for ALL data in each data class held within each DPR entry for the Halifax. I have listed the Registration number for each entry but not any data class titles as I am aware of the Copyright notice on the DPR web site. I have also asked for source/disclosure info regarding each data class and for them to state if a data class is "empty" or not.

It remains to be seen now how they react to this request because I believe it's plainly obvious from their form that they would prefer to only supply a limited amount of data regarding any data subject.

They could:

Pretend they've not received the form (Difficult as it was sent recorded delivery)

Ignore the specific data class requests within the form (Possible but I have a copy)

Say they do not have to supply the data held in classes (Possible but refer to the Act)

Actually send me all the data they hold on me (Possible but remains to be seen if they do)

They could .............. (Any Ideas?)

Anyway the 40 days starts from when they received my legal request and enclosed fee, NOT from when they receive their questionable form.

I will post the outcome/progress on the Subject Access Rights Request and my formal complaint to the Data Protection Commissioner as soon as I receive it.

-- Tony Hayter (Tony@Hayter.com), October 09, 2000

Answers

We have also filled in the same form and as you correctly say the Halifax do specify which data you require. I am afraid we have only ticked the mortgage box as that is the problem we are dealing with. I think it would be better if an outside body were to deal with anything to do with information then the building societies could not cover up what we want to see.. It is information about us and I feel THEY do not have the right to be selective.

-- christine singleton (singletons51@hotmail.com), October 09, 2000.

Hi Christine,

In my opinion, the fact that you were not aware till now of the fact that you were possibly being deceived by this form can only serve to confirm it's alleged purpose.

I have now sent my formal complaint to the Data Protection Commissioner and I suggest that you also send a complaint. I have emailed you privately regarding this.

If there is anyone else that has also received this form as a result of issuing the legally required standard DPA Subject Access Rights Request to the Halifax and now has doubts about whether their rights were abused, then please feel free to Email me privately. I have no doubt that the Data Protection Commissioner would wish to be informed as to the extent of this form's use.

Regards,

-- Tony Hayter (Tony@Hayter.com), October 10, 2000.

PLEASE NOTE: Correction to my previous posting. There IS a tick box for complaints on the form and therefore that reference has NOT been included in my formal complaint to the Data Protection Commissioner.

-- Tony Hayter (Tony@Hayter.com), October 10, 2000.

See my latest posting: The HALIFAX - DPA Subject Access Rights - Latest Update. for the latest developments on this.

-- Tony Hayter (Tony@Hayter.com), November 14, 2000.

Thus: Everyone should ask for ALL info on them from ALL data classes. Every SARN costs ten quid, no matter how many 'classes' are involved, so you might as well ask for the lot.

Has anyone been charged more than a tenner? Please let me know if you have.

-- Eleanor Scott (eleanor.scott@btinternet.com), January 10, 2001.

We have written a formal complaint about abbey national to the data protection agency,they have been as helpful as they can.Unfortunately Davis & co are not.Their latest letter duly notes that we are awaiting the outcome from the data prot agency,but in the meantime they await our proposals for payment and unless it is received within seven days court proceedings will commence!(this follows a letter from them stating that abbey national has reviewed how it deals with shortfall cases,and confirms that they will deal fairly and sympathetically,endeavour to provide as much info as possible ,and offering substantial reductions....as long as you telephone them.Our question is now,do we ignore the letter and await court proceedings or reply?

-- Beryl Smith (beryl@lincs.screaming.net), January 11, 2001.