We'd like to remind Forumites to please avoid political debate on the Forum... Read More »
We're aware that some users are experiencing technical issues which the team are working to resolve. See the Community Noticeboard for more info. Thank you for your patience.
📨 Have you signed up to the Forum's new Email Digest yet? Get a selection of trending threads sent straight to your inbox daily, weekly or monthly!
Barclaycard Microfiche..... Information Commisioner upholds complaints
Options

simonp01
Posts: 1 Newbie
1st December 2006
Reference RFA0138931
Dear xxxxxxxx
Thank you for submitting your complaint and supporting information regarding Barclaycard. Please accept my apologies for the delay in my reply. Our investigation into this matter has taken longer than initially anticipated.
Complaints such as yours are treated as 'requests for assessments' under section 42 of the Data Protection Act 1998 (the Act). When we receive a request for assessment, in most instances we have a duty to assess whether it is likely or unlikely that the processing in question has been carried out in compliance with the Act. However, we have discretion as to how we carry out the assessment and as to what action, if any, to take.
I understand from your correspondence that you made a subject access request (SAR) to Barclaycard and made specific reference to bank statements and to charges levied on your account. Barclaycard responded by confirming that it would supply you with information from your bank statements from May 2004 onwards; however statements prior to this date would only be provided at a cost of £3 per sheet. It went on to explain that this was because these older statements were only stored on microfiche which is not a relevant filing system for the purposes of the Act so did not have to be provided as part of a SAR.
It may first be helpful to clarify that although the information contained within your bank statements, such as details of transactions, is considered to be personal data under the Act so must be supplied in response to a SAR, the Act simply states that personal data must be supplied in an 'intelligible form'. This means that the information you have requested must be provided if it is held as personal data, but not necessarily in its original format i.e. as a bank statement.
As you may be aware, the Act only applies to 'personal data' i.e. information which is processed electronically and which relates to a living, identifiable individual. Information which is held in some manual (non-computerised) records can also be personal data for the purposes of the Act if it is stored in what is known as a 'relevant filing system'.
The Information Commissioner's Office (ICO) produced guidance to help data controllers such as Barclaycard decide whether or not manual records were stored in a relevant filing system; however this was amended following a Court of Appeal ruling a number of years ago (Durant v FSA 2003). In light of the outcome of this case, the ICO revised its guidance and narrowed its interpretation of what constitutes a relevant filing system. This guidance suggests that unless the filing system is highly structured, it will fall outside the scope of the Act and led us to conclude that in our view most manual records fall outside the definition of personal data.
We recognise that the definition of a relevant filing system is open to interpretation and that not all parties will agree. During recent months we have once again been reviewing our interpretation of what constitutes a relevant filing system and intend to publish new guidance in the near future, although this is not as a direct result of the recent issues surrounding bank charges. The new guidance is likely to represent a significant shift in emphasis from our existing guidance and our view will be that many more manual records are likely to fall within the scope of the Act.
Following your complaint and others like it we contacted Barclaycard for a detailed explanation of its microfiche system, including how the information in it is stored and retrieved. It was not clear from the response whether or not the system was a relevant filing system; therefore Barclaycard invited me and a number of my colleagues to inspect it and see the system in operation.
Following our visit, we concluded that the microfiche system used by Barclaycard is a relevant filing system for the purposes of the Act. This means that in our view the information is personal data and should have been supplied as part of your SAR within 40 days and for a maximum fee of £10. As a result, it is our view that it is likely Barclaycard has contravened the sixth data protection principle, as this requires data controllers to process personal data in accordance with data subjects' rights.
As I explained above, we are currently reviewing our guidance on relevant filing systems and are placing greater emphasis on the types of systems that are covered rather than those that are not. This will be based on practical examples of non-computerised filing systems. Our decision in this case has been made with this shift in emphasis in mind and it appears that Barclaycard disagrees with us. In light of the Durant ruling and our subsequent guidance, it is difficult to maintain that Barclaycard has acted unreasonably in this matter and it could plausibly argue that its interpretation and subsequent actions were consistent with the accepted view. If this occurs it will be for the Information Tribunal and ultimately the courts to decide which, if either, interpretation of a relevant filing system is correct.
We have informed Barclaycard of the outcome of our investigation and I will now write to it under separate cover with details of your complaint. If it has not done so already, I will instruct Barclaycard to provide you with the personal data you requested as part of your SAR.
It may be helpful to explain that a contravention of one of the data protection principles is not itself a criminal offence and the Information Commissioner has no power to 'punish' a data controller. In such instances, the Commissioner will seek a resolution to the contravention and once satisfied that it has been remedied then in general no further action will be taken.
In addition, section 13 of the Act gives individuals the right to claim compensation if they have suffered damage as a result of a contravention of the Act. If this is something you are interested in pursuing, I recommend obtaining legal advice and pursuing the matter through the courts. The Information Commissioner cannot comment or advise upon any claim for compensation.
Thank you for brining this matter to our attention. Your case will now be closed.
Yours sincerely,
xxxxxxxx
Casework and Advice Officer
Reference RFA0138931
Dear xxxxxxxx
Thank you for submitting your complaint and supporting information regarding Barclaycard. Please accept my apologies for the delay in my reply. Our investigation into this matter has taken longer than initially anticipated.
Complaints such as yours are treated as 'requests for assessments' under section 42 of the Data Protection Act 1998 (the Act). When we receive a request for assessment, in most instances we have a duty to assess whether it is likely or unlikely that the processing in question has been carried out in compliance with the Act. However, we have discretion as to how we carry out the assessment and as to what action, if any, to take.
I understand from your correspondence that you made a subject access request (SAR) to Barclaycard and made specific reference to bank statements and to charges levied on your account. Barclaycard responded by confirming that it would supply you with information from your bank statements from May 2004 onwards; however statements prior to this date would only be provided at a cost of £3 per sheet. It went on to explain that this was because these older statements were only stored on microfiche which is not a relevant filing system for the purposes of the Act so did not have to be provided as part of a SAR.
It may first be helpful to clarify that although the information contained within your bank statements, such as details of transactions, is considered to be personal data under the Act so must be supplied in response to a SAR, the Act simply states that personal data must be supplied in an 'intelligible form'. This means that the information you have requested must be provided if it is held as personal data, but not necessarily in its original format i.e. as a bank statement.
As you may be aware, the Act only applies to 'personal data' i.e. information which is processed electronically and which relates to a living, identifiable individual. Information which is held in some manual (non-computerised) records can also be personal data for the purposes of the Act if it is stored in what is known as a 'relevant filing system'.
The Information Commissioner's Office (ICO) produced guidance to help data controllers such as Barclaycard decide whether or not manual records were stored in a relevant filing system; however this was amended following a Court of Appeal ruling a number of years ago (Durant v FSA 2003). In light of the outcome of this case, the ICO revised its guidance and narrowed its interpretation of what constitutes a relevant filing system. This guidance suggests that unless the filing system is highly structured, it will fall outside the scope of the Act and led us to conclude that in our view most manual records fall outside the definition of personal data.
We recognise that the definition of a relevant filing system is open to interpretation and that not all parties will agree. During recent months we have once again been reviewing our interpretation of what constitutes a relevant filing system and intend to publish new guidance in the near future, although this is not as a direct result of the recent issues surrounding bank charges. The new guidance is likely to represent a significant shift in emphasis from our existing guidance and our view will be that many more manual records are likely to fall within the scope of the Act.
Following your complaint and others like it we contacted Barclaycard for a detailed explanation of its microfiche system, including how the information in it is stored and retrieved. It was not clear from the response whether or not the system was a relevant filing system; therefore Barclaycard invited me and a number of my colleagues to inspect it and see the system in operation.
Following our visit, we concluded that the microfiche system used by Barclaycard is a relevant filing system for the purposes of the Act. This means that in our view the information is personal data and should have been supplied as part of your SAR within 40 days and for a maximum fee of £10. As a result, it is our view that it is likely Barclaycard has contravened the sixth data protection principle, as this requires data controllers to process personal data in accordance with data subjects' rights.
As I explained above, we are currently reviewing our guidance on relevant filing systems and are placing greater emphasis on the types of systems that are covered rather than those that are not. This will be based on practical examples of non-computerised filing systems. Our decision in this case has been made with this shift in emphasis in mind and it appears that Barclaycard disagrees with us. In light of the Durant ruling and our subsequent guidance, it is difficult to maintain that Barclaycard has acted unreasonably in this matter and it could plausibly argue that its interpretation and subsequent actions were consistent with the accepted view. If this occurs it will be for the Information Tribunal and ultimately the courts to decide which, if either, interpretation of a relevant filing system is correct.
We have informed Barclaycard of the outcome of our investigation and I will now write to it under separate cover with details of your complaint. If it has not done so already, I will instruct Barclaycard to provide you with the personal data you requested as part of your SAR.
It may be helpful to explain that a contravention of one of the data protection principles is not itself a criminal offence and the Information Commissioner has no power to 'punish' a data controller. In such instances, the Commissioner will seek a resolution to the contravention and once satisfied that it has been remedied then in general no further action will be taken.
In addition, section 13 of the Act gives individuals the right to claim compensation if they have suffered damage as a result of a contravention of the Act. If this is something you are interested in pursuing, I recommend obtaining legal advice and pursuing the matter through the courts. The Information Commissioner cannot comment or advise upon any claim for compensation.
Thank you for brining this matter to our attention. Your case will now be closed.
Yours sincerely,
xxxxxxxx
Casework and Advice Officer
0
Comments
-
Great to see that. At last, catagoric proof from the ICO that Barclaycard are talking rubbish over the microfiche thing.
Anyone else sending in their letters to barclaycard might be advised to specifically mention that the microfiche IS a relevent system.0 -
That's great stuff, as clearly Barclays are purposely trying to keep our personal data out of the Data Protection Act's scope and so not required to comply with the Principles of security, accuracy, etc. It's a disgrace that a leading high street bank actually WANTS our personal data not to have the protection of the DPA.
I've had a refusal from Barclays to supply the pre-2004 statements after SAR not long ago, anyone got an idea how I should go about trying to get them now this has been decided? Take it it's ok to copy/refer to your letter simonp01 (without your name of course)?
Andy0 -
The above refers to Barclaycard not necessarily to Barclays Bank so put your complaint about Barclays Bank in via the link in Martin's article.
The bank only has a maximum 40 days to respond. If you don’t get a reply, follow up with a phone call and then report it to the Information Commissioner for a breach.
You may want to quote what the above letter says about Barclaycard when you phone to enquire but be aware they may tell you its a separate issue.
Also the above letter is a result of a complaint to the Information Commissioner so you should put in your own complaint to them.0 -
I got my letter from barclaycard saying that information prior to may 2004 is on microfiche and that it would cost £3 per statement to get at it and that the microfiche system falls outside of the Information Act's idea of 'readily available' information so they are not bound by it in this instance.
What next? any ideas on the letter I should write as a reponse - is there a template for that?0 -
Well yes mine is Barclaycard too, same difference though me dear.
Complaint to IC is indeed on the way, which hopefully all Barclays/Barclaycard customers who have this problem will do - it's also worth complaining to the Banking Code Standards Board as it seems a breach of the code about "co-operating as an industry so that you enjoy secure...banking". Purposely keeping information out of the DPA's scope is no way co-operating in regards to security.
It's the same issue so thanks again Simon.0 -
I'm going to send this letter to Barclaycard as my response - I have quoted part of the letter that Simonp01 got - it's worth a try:
Dear Mr Nuttall
ACCOUNT NUMBER: BARCLAYCARD, xxxxxxxxxxxxxx
Thank you for your letter dated 27 November 2006.
The reason you gave me for not allowing me access to my personal data was that the microfiche system is not considered a relevant filing system. You explained that my subject access request was not, therefore, valid under the Data Protection Act.
Please see the following extract from the ICO to an individual who requested their data from Barclaycard, received 1st December 2006. Please note that the ICO deem the Microfiche system as a relevant filing system and have upheld other complaints of this nature already:
‘Following your complaint and others like it we contacted Barclaycard for a detailed explanation of its microfiche system, including how the information in it is stored and retrieved. It was not clear from the response whether or not the system was a relevant filing system; therefore Barclaycard invited me and a number of my colleagues to inspect it and see the system in operation.
Following our visit, we concluded that the microfiche system used by Barclaycard is a relevant filing system for the purposes of the Act. This means that in our view the information is personal data and should have been supplied as part of your SAR within 40 days and for a maximum fee of £10. As a result, it is our view that it is likely Barclaycard has contravened the sixth data protection principle, as this requires data controllers to process personal data in accordance with data subjects' rights’
I sent you cheque for £10 with my first letter dated 13th November. Please access my data and send me the information I requested. I expect to receive the relevant information 40 days from the date of my initial letter.
Many thanks.
Yours sincerely,
ME!0 -
Oooo thats good!
I may have to "borrow" that for mine!:beer:
All the best,
Andy0 -
I sent that letter away and have had no response. Tomorrow is day 40, what would you advise me to do next?
I intend to call them and tell they have not complied with the DPA and will be reported to the IC as a result.
Do I give them another 7 days to provide the missing 4 years worth of statements for the 2 accounts I'm claiming for.0 -
I know this is a relatively old thread, but it's relevant to my question and I need to seek advice from others in support of my actions and to see what is left for me to try here - seems the best place to do this;
- I requested statements from Barclaycard on 22-02-07, but didn't include the £10 fee. I sent the fee on 10-03-07, where the confirmed receipt on 13-03-07 meaning they needed to get these to me by 22-04-07.
- On 05-04-07 I received a letter including statements back to June 2004, advising that the remaining statements where stored on "microfiche", which Barclays didn't consider as being a "relevant storage system" under the Data Protection Act, so they would get the remaining statements within 6-8 weeks from the date of this letter.
- On 14-04-07 I replied to Barclaycard telling them that I knew of complaints from other customers (from this forum and the CAG forums) where the ICO had upheld complaints where they had argued this and the ICO disagreed with them - microfiche is a relevant filing system under the Act, so they need to stick to the 40 day rule. I also added that I estimated that the charges on the 6 years of statements were around £450.00 based on my statements and estimated fees on the remaining ones and asked for these to be repaid.
- The 22-04-07 came and went with no further statements being received.
- On 22-04-07 I logged a formal complaint with the ICO, copying Barclaycard in via snail mail and telling them I wanted to make a formal complaint with them internally.
- On 02-05-07 I received a reply from the ICO upholding my complaint against Barclaycard regarding my Subject Data Request and their refusal to supply further statements - the ICO have said that they are getting so many complaints being upheld from them that they are being "batched" together and sent to Barclaycard on a monthly basis. They have ordered Barclaycard to send me my statements immediately, but they won't be sending my formal response to them until June as the complaint was upheld in May.
- Today I've drafted a further letter to Barclaycard telling them of the ICO's decision, including a copy of the email I've received from them, asking them to provide the remaining statements within 7 days from now. I have also told them that I think their behaviour is tantamount to a "concealment of information" which is aimed at reducing my legal liability under the Limitation Act, as they are in essence reducing the amount I can claim within 6 years by dealing the receipt of the information I need to progress my legal claim - I've argued in the letter that, if this is found to be the Court's opinion also, that they may remove the limitations on the claim allowing me to go back and claim as far back as the account was opened, not just 6 years of charges. I'm also using this letter as my final letter before action, giving them 7 days to pay the charges or I'll start a new claim against them.
The questions I have are;
- Is anyone else in the same boat with Barclaycard and if you've had you're statements, what did you do to get them?
- Am I on dodgy grounds starting a claim for £450.00 based on my "estimated charges", when I can't legally prove these either way with evidence?
- If I still don't get any response from them, what action can I take on their continuous refusal to provide statements despite my arguments above and a upheld complaint from the ICO?
- Notice that I haven't had a formal response to my formal complaint with Barclaycard - I was hoping to get this from them then take that complaint to the FSA Omsbudsman's, but they haven't responded - can I take a complaint to the FSA without having a full response from the bank, first?
Sorry for the lengthy post, but this is all relevant to the questions I'm asking. Thanks in advance for any replies!
If you're part way through this process, don't let them grind you down!0 -
I sent the standard letter to BarclayCard on 12/03/2007 requesting my bank statements within a 40 day period.
I heard nothing,so sent them a reminder about my request 20/04/2007.
I recived my statements 02/05/2007 back dating to 2004 , the rest i told were on micro film an would take a further 6 weeks to send. I replied to them thatI would like to point out the following recent information relating to an investigation by the Information Commissioner.
I am aware this relates to Barclaycard, however, logic states that you should also act on the Information Commissioners findings, that “Following our visit, we concluded that the microfiche system used by Barclaycard is a relevant filing system for the purposes of the Act. This means that in our view the information is personal data and should have been supplied as part of your S.A.R - (Subject Access Request) within 40 days and for a maximum fee of £10. As a result, it is our view that it is likely Barclaycard has contravened the sixth data protection principle, as this requires data controllers to process personal data in accordance with data subjects' rights.”
and that i would allow them a further 7 days to send me the information or i wouldnt hesitate to contact the information Commissioner regarding forwarding a complaint.
I recieved no reply or contact since.
time goes by an i contact the Information commition filing a complaint on 17/05/2007. now awaiting a reply.
So im like almost double the 40 days an still not recieved what i asked for ..
Is there anything further i can do , when phoning barclaycard im told " the matter is being dealt by the appropriate people "
Any help much appreciated0
This discussion has been closed.
Confirm your email address to Create Threads and Reply

Categories
- All Categories
- 350.8K Banking & Borrowing
- 253K Reduce Debt & Boost Income
- 453.5K Spending & Discounts
- 243.8K Work, Benefits & Business
- 598.6K Mortgages, Homes & Bills
- 176.8K Life & Family
- 257.1K Travel & Transport
- 1.5M Hobbies & Leisure
- 16.1K Discuss & Feedback
- 37.6K Read-Only Boards