Limit to your Data Subject Access Rights

jonpress

.... to everyone who has pointed me to N Hunter. I'll certainly pursue that and see if they have anything on file.There's certainly nothing adverse on file with any credit reference agency.

As it happens, the line of business I'm in involves the security of financial transactions for some high street institutions, so being squeaky clean is of significant importance: perhaps even more to some of your financial dealings than mine!

As has been pointed out, there is a critical distinction between the information (whether accurate, speculative or malicious) collected by a financial institution and the use they make of it. If they simply spin a bottle to decide who gets credit they're entitled to keep that a trade secret. Similarly, the algorithm they use to perform credit scoring is a reasonable trade secret. However, the raw information they gather to perform this processing isn't a trade secret in any reasonable reading of the DPA and ought to be disclosed as it cannot otherwise be corrected if wrong.

I actually challenged the ICO case officer with a hypothetical case in which a company's lending decisions imight involve making assumptions about an applicant's ethnic group. He appeared to suggest that it would be acceptable to keep the "ethnic estimate" a secret from the data subject since it would be a protected business method, even though the business method itself could result in illegal discrimination. Since the ICO (apparently) trusts companies not to discriminate illegally, no benefit would allegedly accrue to the data subject to know that they had been racially profiled as no improper use would be made of that information. In their opinion of course.

This is clearly nonsense, but unfortunately the avenues for appealing this type of decision are extremely limited.

jonpress

I've had a letter back from National Hunter saying they have no record of me. So the mystery deepens!

witches_cauldron

I thought Hunter had records of everyone?

jonpress

Just a further update. The ICO have now completed my request for a case review and have said that I was right to say that that Egg could not use the "trade secrets" defence to withold information, but that "it is likely another exemption would apply" and "it is likely... the information will not be available to you under the DPA". They are apparenty writing to Egg again, apparently asking them to come up with a different reason for witholding the information.

I find this all rather depressing. The ICO team seem woefully timid - simply accepting invalid excuses from data processors and, when challenged, offering them the opportunity to try another one. Since, of course, the case review can't be reviewed again, it doesn't really matter what they say this time round since there is no further opportunity to challenge it!

Jimbo65

Sorry to hear of your troubles, I hope you fight them all the way. Who'd have expected Egg to behave in such a way eh?

bert&ernie

More details on HUNTER here...

http://www.experian.co.uk/www/pages/what_we_offer/products/hunter.html

Although I believe it is possible to do real-time HUNTER checks, I believe many card issuers only use it in offline mode i.e. it is checked after the application is accepted, but before a card is sent out. This is certainly the case with the older versions of this system which relied on locally installed databases rather than the current managed service offering that was launched after Experian acquired the technology.

Given that the OP's application was initially accepted, I would suggest its highly likely that HUNTER flagged up something that the lender didn't like. Hunter wouldn't necessarily have to have a record of you for it not to like your application - it may simply have decided it looked too similar to applications that it has previously found to be fraudulent.

Fraud prevention isn't the same as credit referencing. HUNTER isn't a way of obtaining information about you - its a way of comparing your application to the profile of suspected and known fraud.

Its an interesting one from a DPA perspective, but the ICO is probably right.

YorkshireBoy

bert&ernie wrote: »

HUNTER isn't a way of obtaining information about you

I remember reading on their website that they hold, and share, details of an individuals employment, position, & salary details (amongst other things).

I understand whenever you apply for credit, the information you provide is sent to Hunter, where it's compared to that supplied for other credit applications you've made (reciprocity?).

Maybe I misunderstood?

bert&ernie

YorkshireBoy wrote: »

I remember reading on their website that they hold, and share, details of an individuals employment, position, & salary details (amongst other things).

I understand whenever you apply for credit, the information you provide is sent to Hunter, where it's compared to that supplied for other credit applications you've made (reciprocity?).

Maybe I misunderstood?

I'm not saying that National HUNTER wont contain personal information, just that the lender isn't actually looking for your data when they check your application against National HUNTER.

Now, I think there are still legacy implementations of hunter that have a different scope to National Hunter e.g. they use local databases or have other types of closed user groups. This could explain why National Hunter have no record of the OP.