Broker running credit searches against my wishes...

droiderm

That's actually quite shocking :-S
I can understand the need to hold certain information for a defined period of time, but to hold all of the information is not necessary in my opinion.

I thought one of the parts of the Data Protection act was only to hold personaly information as long as you need to? Do you really need all of someones personal information for SIX years?

ILW

Might be worth considering that OP is also considering withholding the fact that he is a bankrupt from any mortgage application on a basis of "they will probably not find out".

More to this than a dodgy broker.

kingstreet

We only hold information necessary to advise someone for a mortgage. It's more or less what you put on a mortgage application, apart from the addition of a few soft-facts, "what ifs?" you might call them.

If we weren't allowed to keep this information, we'd never be able to defend any complaint made against us.

What information would you determine we shouldn't retain?

droiderm

It's not for me to say.
But information "you had gathered" could be wide ranging and irrelevant for the purposes of complaints?
For example credit reports.

Let me throw the question back to you, do you think it's right that an individual/small company/large company should keep very personal information about you for 6 years? What guarantees are there about security etc? I guess it could be a lot of information for a lot of people "lying around".

I personally think there should be very strict guidelines on what is appropriate in this scenario. And even then, that information should be retained by a central body for security /audit purposes.

BTW I am not having a pop at you, just the situation.

kingstreet

ILW wrote: »

Might be worth considering that OP is also considering withholding the fact that he is a bankrupt from any mortgage application on a basis of "they will probably not find out".

More to this than a dodgy broker.

I see what you mean.

Worth bearing in mind by the OP, a previous bankruptcy will be picked up by the solicitor's bankruptcy search they do close to exchange. That will be enough to have the mortgage offer withdrawn by the lender when it finds out, if not disclosed at the outset.

When we bought our current property, our solicitor's search found a bankrupt with the same name as my wife and we had to certify it wasn't the same person.

kingstreet

We only gather information relevant to what we're actually doing for the client. A typical mortgage factfind gathers name and address, employment and income, credit commitments and the borrower's attitude to issues such as interest rate risk, fees, penalties, basically the things which we need to correctly advise someone.

As it's this data on which we base our recommendations, it would be difficult, if not impossible, to divorce the advice record from the data on which it was based.

We clearly explain the Data Protection implications at the outset of any appointment, as should any other organisation doing something similar.

do you think it's right that an individual/small company/large company should keep very personal information about you for 6 years?

I have to say, I believe in retaining the information needed to defend a complaint. Given the current fashion of complaining about just about everything an adviser has done, on a fairly open-ended basis, I can see some firms keeping data even longer. The period mentioned is a minimum, after all.

dunstonh

so I sent him a lengthy, polite email asking him to delete any sensitive information he may hold about us and specifically asking him not to run any credit checks or searches (as this could negatively affect my credit score). I then spoke to him on the phone to make sure he had received the email, and he said he had and he wouldn't progress any further.

He cant remove your information and he hasnt run the credit search. If it was him then it would not say Nationwide. Somehow Nationwide have run the search and that is what you need to find out.

Really, isn't that against Data Protection too?
If you were holding my personal information for ever, I would have a complaint to make.

Data protection requires you to hold data for as long as deemed necessary. FSA recommend 6 years in most areas but some is indefinite. We hold data forever as there is no 15 year time bar in financial services. So, there is a lifetime of liability which then allows the data to be retained indefinitely and still remain in accordance with the data protection act.

Let me throw the question back to you, do you think it's right that an individual/small company/large company should keep very personal information about you for 6 years? What guarantees are there about security etc? I guess it could be a lot of information for a lot of people "lying around".

Yes. When you as a consumer have the right to complain about that now or after 6 years it is only fair the firm retains documents that allows it to protect itself.

If you look back to endowment complaints, a lot of firms destroyed their data that was over 6 years old but when people complained, where there was no documentation the complaints usually resulted in payouts. Indeed, our compliance company recorded stats that showed that out of 1000 endowment complaints on average, 25 were upheld complaints (genuine provable wrondoing) but a further 225 got redress because of missing, incomplete or inadequate documentation with a further 750 rejected.

So, let me throw it back to you if you had a lifetime of liability on the advice you give wouldnt you retain documents that support what you have advised and done?

I personally think there should be very strict guidelines on what is appropriate in this scenario. And even then, that information should be retained by a central body for security /audit purposes.

There are strict guidelines and the FSA can fine firms that dont follow it. The FSA actually takes a stronger position on this than the data protection commissioner. However, asking for all the data to be retained by one body actually makes the chances of a data protection breach more likely.

droiderm

However, asking for all the data to be retained by one body actually makes the chances of a data protection breach more likely.

Do you think ?

I would imagine the security of a central body (at least compared to small firms / individuals ) would be way better.

I can just picture "stuff" lying around in peoples office/home.

I guess if the security is guaranteed, I can understand why, but I still don't agree with it.

Cue high profile data protection breach..... ;-)

ILW

Anyway

In the OPs case, I would not have thought that a single search by Nationwide is going to have any effect as to whether he can get a mortgage or not.

dunstonh

droiderm wrote: »

Do you think ?

I would imagine the security of a central body (at least compared to small firms / individuals ) would be way better.

I can just picture "stuff" lying around in peoples office/home.

I guess if the security is guaranteed, I can understand why, but I still don't agree with it.

Cue high profile data protection breach..... ;-)

Some of the biggest data protection breaches have come from firms employing third parties to do jobs. Most common is the transferring of data from the location to the storage destination. So, under your proposal, more firms would be doing that which increases the chances of data protection breaches.

There are FSA guidelines on data protection and firms are checked on their compliance visits to make sure they are complying. That is a damned site better than most other retail industries that have to comply with data protection but dont have anyone checking on them.