Egg refuse to close off internet access to my closed accounts!

Paul_Herring

JamesU wrote: »

[...]After two years I am still logged in! [...]

But....under personal details, absolutely everything is still there and correct: e-mail, full address, date moved there, residential status, home phone, work phone, mobile, marital status, employment status and finally......occupation!

I do believe that could be construed as a breach of the Data Protection Act.

JamesU

Paul_Herring wrote: »

I do believe that could be construed as a breach of the Data Protection Act.

PaulHerring, this is a grey area to me. If you are able to elaborate on this a little when you have a moment I am all ears.

JamesU

arthur_22

Ray, it's good to hear that someone has succeeded in getting net access closed off - it's not beyond Egg's capabilities then! There's hope for me yet.

Paul_Herring

JamesU wrote: »

PaulHerring, this is a grey area to me. If you are able to elaborate on this a little when you have a moment I am all ears.

JamesU

Note: I'm not a lawyer, I just play one occasionally on the internet

http://www.ico.gov.uk/what_we_cover/data_protection/the_basics.aspx

The Act works in two ways. Firstly, it states that anyone who processes personal information must comply with eight principles, which make sure that personal information is:

* Fairly and lawfully processed
* Processed for limited purposes
* Adequate, relevant and not excessive
* Accurate and up to date
* Not kept for longer than is necessary
* Processed in line with your rights
* Secure
* Not transferred to other countries without adequate protection

There is absolutely no reason for them to hold all that data for 2 years on a dormant account that is not going to be re-instated. The longest I'd personally expect them to hold the data is 13 months from the last transaction to take into account the likes of AA invoking a CPA.

http://www.opsi.gov.uk/acts/acts1998/ukpga_19980029_en_9

5 Personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes.

Possibly relevant to requests to disable the account:

7 Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.

Possibly relevant to your mentioning Citi-bank/US:

8 Personal data shall not be transferred to a country or territory outside the European Economic Area unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data.

JamesU

Paul_Herring wrote: »

Note: I'm not a lawyer, I just play one occasionally on the internet

Do not need to be a lawyer to get things done a lot of the time, provided you have decent information, understand it and reason it through;)

Thanks. Really appreciate this info, useful to others on the thread in a similar position also. Will draft a letter and post back the result for info.

RayeWolfe, by "escalating to a higher authority," do you mean sending a letter to a more Eggspecific department rather than to general customer services address? Thanks.

JamesU

RayWolfe

JamesU wrote: »

RayeWolfe, by "escalating to a higher authority," do you mean sending a letter to a more Eggspecific department rather than to general customer services address? Thanks.
JamesU

No, it was a telephone call escalated to a "supervisor" at customer services.

JamesU

RayWolfe wrote: »

No, it was a telephone call escalated to a "supervisor" at customer services.

Thanks for this. In that case will stick with a letter to EggGeneral, more accountability built in and less time wasted.

JamesU

jamesd

Interesting that you may have terminated your relationship with them prior to the Citibank purchase. In which case you would not have had an active account or agreement permitting them to transfer your personal data outside the UK.

Their practice clearly fails the obligation to process securely since it's basic security to terminate access for all accounts that are no longer active.

JamesU

jamesd wrote: »

Interesting that you may have terminated your relationship with them prior to the Citibank purchase. In which case you would not have had an active account or agreement permitting them to transfer your personal data outside the UK.

Their practice clearly fails the obligation to process securely since it's basic security to terminate access for all accounts that are no longer active.

Regarding first part above, a good point but at least on my side unlikely to be the case. First zero balance in May 2008 according to statements, and this would have been after the merger which occurred some time in 2007. So in effect probably within their rights on the data sharing front as they would have been covered by the new T+Cs, but one of the reasons I wanted to close the account down.

But for sure, the second point should stand anyway. Common practice (and common sense) to close things down properly, never come across this with a provider before, as others on the thread have also pointed out.

JamesU

Serif

It just occurred to me whilst reading through this thread, assuming you want to close down your account, and since Egg seem to vary their T+Cs so frequently, what would happen if you chose to reject their suggested changes?