Whilst searching I found the below post from another site. I think it raises so very valid points and certainly some I will be looking into. I thought id post it for your views and comments.
So start off with-
The very first line of the First Principle of the Data Protection Act states that "Personal Data shall be processed fairly and lawfully"......
It is my contention that the processing of my data by T-Mobile has been unfair and unlawful from the start of the contract. And although T-Mobile
may claim that they have a legitimate interest under s6 from reading the Information Commissioners Office guidelines on the Data Protection Act I do not believe they can rely on it in my case since
Meeting a Schedule 2 and Schedule 3 condition will not, on its own, guarantee that processing is fair and lawful. The general requirement that data be processed fairly and lawfully must be satisfied in addition to meeting the conditions..
Because their processing was unfair and unlawful, they lose the right to claim legitimate interest.
When I first applied for one of their phones I was only 20 [change that age if
it is wrong] and had no experience of ever having had financial problems.
Accordingly I had no knowledge that Credit Reference Agencies even existed,
let alone the functions they performed for the financial sector.
You will no doubt have noticed that T-Mobile maintain they are a paperless
organisation-so much so that despite asking on numerous occasions over the lifetime of my contract with them, I have never had the opportunity of
seeing a copy of their full Terms and Conditions in writing until this Court case
forced them to supply me with one.
Moreover, their website has proved of little help either since all it discloses there are the following phrases-
"Your personal details are not held indefinitely, but are destroyed after a period of time. Some information will be held after you have closed your account with us.”
"Your personal details are not held indefinitely, but are destroyed after a
period of time".
"Some information will be held after you have closed your account with us."
"We share information with our parent company and business associates”
I expected that when they talked of "Business Associates"
they would be companies that sold ancillary products for T-Mobile phones-hands free accessories for use in the car for example.
There is not a single mention there that they would supply the CRAs on a
monthly basis with details of my ongoing history. And they certainly did not
mention, as you can see, that in the event of me having several missed
payments, that they would not only place a default on my file, but that it would remain there for six years.
One of the conditions in deciding whether data is being processed lawfully is
that the data subject should have legitimate expectations of how his data
will be used.
I had no idea, and nor was there any indication from T-Mobile, either in writing
or on their website [which by the way, I had no access to in those days]
how my data was going to be treated. I was shocked when I finally found
out what they had done. I could not believe that they could do this without my permission. And as I have already said ,there is nothing on their contract
or website that indicates that they would inform CRAs.
Therefore I would respectfully submit that they their processing has been
unlawful from day one of my contract with them, and plead that it should no longer be displayed.
Another form of unlawful processing occurs when a company acts ultra vires
and T-Mobile have acted in this manner twice in relation to my processing.
First, they have arranged a contract between themselves and the CRAs
whereby CRAs are expressly forbidden from altering, amending or blocking
my data without the permission of T-Mobile. This is in direct contravention
of both the Data Protection Act and the Consumer Credit [Credit Reference Agency] Regulations 2000. In both laws, I have a statutory right to ask the CRA to
alter, amend or delete certain personal data should they believe merits such
action. This contract prevents them from doing so, and is a flagrant abuse of their power over the CRAs and a denial of my legal rights. And as a result,
while the CRAs sympathise with my plight, they are unable to stop
processing my data as T-mobile refuses to allow it.
Second. Although my contract has terminated, they insist that they are
within their rights to continue processing my personal data, namely a default
on my account when I was having financial problems. Defaults have no legal
standing, and yet T-Mobile are insisting that they are within their rights to
process this information. As a result, I am paying a higher interest rate on my
current overdraft, it is virtually impossible to arrange finance of any kind, and
I will be unable to start in a better job unless the default is removed. I will
leave it to your own good judgement, should you decide to have the default
removed, whether to add any compensation to my claim for the harm that I have suffered.
In addition to their processing being unlawful I submit that it is unfair too.
As at no time have I ever been supplied with the "Fair Processing" information
as indicated in the Information Commissioners Office guidelines. And I notice that they have not supplied me with a copy even now with this Court case in progress.
These are some of the details that are included in the information, and it was only recently that I discovered I should have been furnished with them at the outset and so I should have been told
the purpose or purposes for which the data were intended to be processed, and
(d) any further information which is necessary, taking into account the specific circumstances in which the data are or are to be processed, to enable processing in respect of the data subject to be fair.
In deciding whether, and if so, what, further information is “necessary” to satisfy (d) above, data controllers should consider what processing of personal data they will be carrying out once the data have been obtained and consider whether or not data subjects are likely to understand the following:-
(a) the purposes for which their personal data are going to be processed;
(b) the likely consequences of such processing such that the data subject is able to make a judgement as to the nature and extent of the processing; and
(c) whether particular disclosures can reasonably be envisaged.
It would be expected that the more unforeseen the consequences of processing the more likely it is that the data controller will be expected to provide further information. This aspect also has a bearing on the question of what amounts to consent (see specific consideration of this issue at paragraph 3.1.5 above); in the same way that consent must be “informed”, so data subjects themselves must be fully aware of the ways in which their personal data may be processed in order for that processing to be considered fair.
In the context of the 1984 Act, the Data Protection Tribunal has supported the Commissioner’s view that personal information will not be fairly obtained unless the individual has been informed of the non-obvious purpose or purposes for which it is required, before the information is obtained. (Innovations (Mail Order) Limited v The Data Protection Registrar (September 1993)).
Where companies do provide full details of reporting to CRAs and how their customers mayl be affected by missed and late
payments, the absence of the fair reporting schedule might not be so
serious, but with T-Mobile providing such a dearth of information on
those vital topics, one would expect that it should be virtually
mandatory that the fair reporting booklet be supplied with all their contracts to avoid charges that their processing is unfair from the very
You will notice that I was not even informed of the obvious purposes for the
use of my information , let alone the non obvious purposes. If you bear in mind my age at the time I took out the contract, the complete lack of any
relevant information as to how my data would be processed surely makes
the processing unfair and therefore should not be processed any longer
Returning to the lack of information concerning notification
of missed payments etc to CRAs. I have alraedy submitted that the
omission of any indication of their use came within the unlawful
processing condition, but I believe it comes within the unfair processig too.
The fair processing requirements (Schedule 1, Part II, paragraphs 1 to 4) - Paragraph 1
Paragraph 1 provides that in deciding whether or not processing is fair, the way in which personal data are obtained will be considered.
This will include particular reference to whether any person from whom the personal data are obtained is deceived or misled as to the purpose or purposes for which the personal data are to be processed. As has been explained previously, this may also have a bearing on the validity of any consent given by the data subject to the processing, which in turn may remove the basis for processing which was being relied upon by the data controller.
The use of "Business Associates" which T-Mobile may
believe encompasses CRAs is so misleading and reinforces my belief
that their processing of my data was, and still is , unfair and should ceaseMoving on to the question of whether T-Mobile ever had my consent to process my data, A Eu directive defines it this way Consent by a data subject is defined as .." any freely
given and specific informed indication of his wishes by which the data subject signifies his agreement to personal data relating to him being processed."
Claimant therefore maintains that consent to process
personal data has not been consented to by reason of insufficient information supplied by Defendant.
Once again there is a huge question over the legitimacy of processing data.
Should you fail to accept that the processing was unlawful, unfair and
did have my consent, then the legitimate interest of the Defendant
must be examined.
For a start, the contract has ended. And with it should die any interest
of the Defendant in my affairs. There is no statutory right conferred
on companies to process data on their ex customers. Nor is there any
specific right alluded to on the Defendants website.
"Some information will be held after you have closed your account with us." gives no indication of the type of information that would be
retained. Obviously there would need to be data held for Inland
Revenue purposes and from their own accounting procedure requirements, but that is a far cry from passing data to a CRA which
would then be available to all and every one of their members who
wished access to the Claimants credit file. And the same argument can be used for the other statement-"Your personal details are not held indefinitely, but are destroyed after a period of time". No one could
possibly envisage from those two statements, that the Defendant
was pointing out that they would contnue to process data for six years
after the account terminated.