HSBC prematurely deleting financial records

FreddieFact

I have been an account-holder with HSBC since 2003. When I joined the bank I applied for, and was given, a credit card. I am 99% sure that the agreement included PPI and believe it was mis-sold. The combination of interest and PPI meant that I was never able to reduce the balance owing on the card and eventually I took out a consolidation loan, destroyed the card and repaid the full balance (due to an administrative hiccup a balance of around £4-5 remained on the account for a further 12 months). This was in August 2007 - LESS than 6 years ago. I have no paperwork relating to the CC account. The bank loan was repaid in August 2012. I do have the paperwork for the bank loan where I declined the PPI option, but where interest was obviously paid on the accrued interest/PPI charges from the credit card.

Having initially confirmed this through Noddle, and then through my online bank account statements from HSBC, I called in at my branch to ask for the full number of the credit card (the middle 6 digits are blanked out on the statements) but my computer file showed no record of the credit card. I contacted HSBC by phone and they denied that I had ever held this card - until I got them to look at my online statements which showed the monthly direct debit payments and eventual repayment. Their representative agreed that I had clearly held this card and could not explain why they had no record of it. She offered to begin the PPI claim there and then.

Today I received a letter form the PPI Claims department stating

Having searched our records I cannot find any evidence that you have taken out any Card Repayment Protector with HSBC.

Due to the Data Protection Act, HSBC cannot keep records indefinitely therefore if the Payment Protection Insurance commenced over six years ago, any records may have been destroyed.

followed by a request for me to provide the documentation, the complaint being closed until then.

Surely the statement in bold is incorrect, should it not state "if the PPI ENDED over 6 years ago ......"? Otherwise if I still had PPI which started 7 years ago they would already have destroyed the records!?! As they do not hold the records they should for the credit card, I was not surprised to find that they held no records for the PPI.

Is it worth pursuing this with HSBC or should I just refer the matter straight to the Ombudsman?

[Deleted User]

FreddieFact wrote: »

Surely the statement in bold is incorrect, should it not state "if the PPI ENDED over 6 years ago ......"? Otherwise if I still had PPI which started 7 years ago they would already have destroyed the records!?!

Banks typically keep records for six years, but it's not a legal requirement either way.
If you want to see all that they actually have on file for you then you'll need to send a Subject Access Request (SAR) letter which costs ten pounds. There is an excellent template here:
https://forums.moneysavingexpert.com/discussion/1475553

You cannot approach FOS at all until the Bank have actually rejected a PPI complaint. Since it appears you had no PPI, it's difficult to see what your complaint would actually be.

dunstonh

Surely the statement in bold is incorrect, should it not state "if the PPI ENDED over 6 years ago ......"? Otherwise if I still had PPI which started 7 years ago they would already have destroyed the records!?! As they do not hold the records they should for the credit card, I was not surprised to find that they held no records for the PPI.

Is it worth pursuing this with HSBC or should I just refer the matter straight to the Ombudsman?

There are no rules to follow. Just guidance from the regulator which you can choose to follow or not. A lot of card providers keep a rolling 6 years of data. So, the destroyed credit card data makes sense.

That said, it could also be human error. Banks do not have state of the art computerised filing systems that keep a complete history. A lot of what they have is paper filing and unlinked archives. So, very easy to miss things.

If the letter is a final response, then you can go to the FOS. The FOS will ask them to look again but if they again find no record, then that is the complaint over. You will be asked to supply evidence you had it if you persist and the bank say no record. If you have none, the bank has none, then its game over.

dazza12

Moneyineptitude wrote: »

Banks typically keep records for six years, but it's not a legal requirement either way.

There are however other acts that require data to be retained for a period. The Money Laundering regulations require details of a transaction (in the case of a loan account, the agreement and associated transactions count as one transaction) for a period of at least five years after the relationship has ended. In addition the Companies Act requires accounting data to be retained until the start of the accounting period after six full years (potentially seven years). There are further requirements under other acts depending on the type of transaction.

Many banks use the FSA guidelines to avoid supplying this data, and will often wrongly suggest that they don't have to supply older data. What they should do is supply the data if they hold it.

Did you request a SAR prior to your complaint to HSBC? If you haven't, it may be worth your while putting in a request for the data. This should confirm either way whether HSBC have the records. There is a requirement to search 'relevant filing systems' which may involve a manual paper or microfiche search or even a copy of an older computer system. This wouldn't normally show up on a search on a branch terminal.

HSBC have been known to produce data from 2001/2 and in some cases further back so it may be an option if you want to take it further. In addition it's extra evidence that will help if you were to take it to FOS.

FreddieFact

Big thanks to you all for your advice above. One last question regarding completion of the template for the SAR. When inserting my account number should I just include the number of my current account or also add the numbers of the loan accounts (which I have, though they are not part of my claim) and the Credit Card, which I have most of (6 digits missing!). Would this at least avoid them telling me again that I have never held a credit card with them and maybe make them look a bit harder?

-taff

They won't look any harder for anything. A SAR is a SAR. If the records exist, they will send them, to you, if they don't , they won't. Give them as much infomration as you have, including past addresses etc.

Take out the part about proving they have destroyed records, they don't have to do that.

magpiecottage

dazza12 wrote: »

There are however other acts that require data to be retained for a period. The Money Laundering regulations require details of a transaction (in the case of a loan account, the agreement and associated transactions count as one transaction) for a period of at least five years after the relationship has ended.

In theory that is true but in practice, regulators expect firms to take a proportionate approach. If a bank can show its practice was within Joint Money Laudering Steering Group guidance at the time that would be a defence.

In addition the Companies Act requires accounting data to be retained until the start of the accounting period after six full years (potentially seven years).

Although accounting records are needed for taxation and other purposes, a data controller would not normally retain it in a format where the individual account holder was readily identifiable.

Many banks use the FSA guidelines to avoid supplying this data, and will often wrongly suggest that they don't have to supply older data. What they should do is supply the data if they hold it.

That is correct - but only to the extent that it can be readily identified from the information provided by the data subject.

FreddieFact wrote: »

One last question regarding completion of the template for the SAR. When inserting my account number should I just include the number of my current account or also add the numbers of the loan accounts (which I have, though they are not part of my claim) and the Credit Card, which I have most of (6 digits missing!). Would this at least avoid them telling me again that I have never held a credit card with them and maybe make them look a bit harder?

The rule of thumb is could a reasonably competent temp, with no particular knowledge of the data controller's systems find it with the information you have give.

So the more you tell them the more they are likely to tell you.