Banks rejecting claim using Data Protection act

The data protection act requires firms to destroy data when it is no longer required. Interpretation allows firms to decide how long that is. However, the FCA issue guidance and 6 years is most frequently advised timescale for things that are not high risk or have regulatory issues.

Small firms are likely to destroy data quicker than the banks. For example, banks have to maintain a record of account numbers issued when linked to sort codes. Whilst paperwork may be long gone, the account code linked to that account number would tell them the type of account that went with it. For example, Lloyds had an account code that indicated personal loan with PPI and a different code for without. This begins to make it easier to recreate data.

Barclays have been bringing long filed away paper records back onto their systems. They used a method of archive rather than actual destruction and that allows for bring records back. Others did not.

So, it really varies with the bank and it will vary on the timescale and the sort of data they will have and how it is filed.

If you are an existing customer within their group, they will typically hold data for much longer than when the relationship has ended.

Bottom line is that if you don't believe them, then spend £10 per bank and do a data subject access request.