ERUDIO student loans help

eroneo

anna2007 wrote: »

"I am also unclear on what legitimate interest or justification Erudio has in reporting deferred loans to CRAs, particularly as such reporting would exclude deferred borrowers on the later agreement, as well as borrowers in repayment. It is simply not acceptable for some deferred loans to be reported to CRA's and not others: all student loans should be reported on the same basis, i.e. when the borrower defaults on repayment. What is achieved by the reporting when only certain student loans are being reported, and how is this balanced against these borrowers’ legitimate interests in the processing of their personal data, such as the right to give informed consent to disclosure, or their right to privacy? ...

If the legitimate interests rule is satisfied, does that mean that they can disclose whatever they like regardless of what it says in the contracts?

i.e. If the contract said "We promise to keep your data secret and will not disclose it to anyone."

Would the legitimate interests rule still allow disclosure?

Even if the legitimate interests rule is satisfied, the disclosure would still need to be "fair and lawful" under the first principle of data protection. It could hardly be fair to promise secrecy and then rely on "legitimate interests" to break that promise.

If the wording of the contract and previous conduct infers they will not disclose and the borrower is lead to believe that, then subsequent disclosure would mean the borrower was misled even if there are legitimate interests.

I do not think they are confident to rely only on legitimate interests, otherwise they would not be reporting some loans and not others.

When it comes to fobbing off, the legitimate interests exception is useful to disuade dissent from borrowers.

Fobbing off is one thing. Having it put to the test before a judge would be another.

(I will get back to answer your question soon.)

fermi

:huh: :think: :huh: :think:

https://ico.org.uk/for-the-public/credit/

Why are the CRAs allowed to hold all this information on me? I haven’t given consent for this.

The Data Protection Act (DPA) doesn’t actually require the CRAs, or any other organisation, to have your consent before they are allowed to process your personal data as long as they have a legitimate reason for doing so and you have been told what is going to happen to your data.

If you have taken out a loan or credit card you will probably find this in the original terms and conditions that you signed.

Because lenders rely on the information provided by the CRAs, it’s likely that they will refuse you credit if you don’t agree to your information being shared with a credit reference agency. However, organisations wishing to process sensitive personal data about you are subject to tighter controls around what constitutes a ‘legitimate reason’ for processing your data and may need to rely on consent more often.

For the purposes of the DPA financial information is not distinguished as being ‘sensitive’ personal data.

Do companies need my consent to carry out a credit search?

The DPA doesn’t actually require these companies to have gained your consent before they can carry out a search of your credit file as long as they have a legitimate reason for doing so and you have been told that this search is going to take place. If you have taken out a loan or credit card you will probably find this in the original terms and conditions that you signed.

Brooker_Dave

Is this good news or bad news?

rizla_king

Neither as the ICO and BIS dont care. Most judges wont either unless your prepared to pay a top barrister £10,000s and appeal all the way to higher courts. Even then like Richard Durkin you have to more or less bankrupt yourself to do it.

anna2007

heartbroken wrote: »

The exact wording of my response from FOS on that point:

"...I do not think that the financial ombudsman service is the appropriate forum to test any legal claim that Erudio are obliged to accept deferments without completion of its forms. It is not our role to provide legal opinions or rulings on technical points of law. A judgement on this issue would be better suited to a court…"

BorderReiver14 wrote: »

The fos recently told me for example that the legislation may not spell out that we have to use a daf but it does not say we shouldn't either and as such they feel the ambiguity is something that leaves them the only option of commenting on what is 'right and reasonable' i.e ...use a daf!

FOS's reasoning here really is perverse. Their job is to help resolve disputes as an alternative to court action, by looking at the facts of a complaint, and reaching a decision based on what's fair and reasonable.

The facts -

Is there a prescribed format for the deferment applications in the regulations or loan agreement? No.

Do the regulations prohibit the use of a DAF by the lender? No.

Do the regulations prohibit the use of a bespoke letter by the borrower to apply for deferment? No.

Is the DAF fit for purpose (only asks for the information necessary to assess the deferment application)? No.

What's fair and reasonable:

Is it reasonable for Erudio to have a standard DAF for borrowers to use? Yes.

Is it reasonable for that DAF to seek agreement to new terms (old DAF), or terms not shown on the form (new DAF)? No.

Is it reasonable for Erudio to make deferment conditional on the use of that DAF? No.

If FOS really can't see what's fair and reasonable based on the facts, then either they're not very good at their job, or they're not being independent/impartial and are showing bias towards Erudio.

BorderReiver14

I agree, my adjudicator even went so far as to say they considered SLC to have made a mistake in not reporting us to CRAs. The tone they used was terse to say the least and I felt I was being talked at and talked over at times. I really have very little faith in them coming down on our side but hey ho, I can say its an avenue I tried to settle my dispute with ESL.

fermi

I'm sure people are, but everyone not happy with an adjudicator decison should reject the decision and insist it is taken to a full ombudsman. probably won't do much good, but they are in general sightly less idiotic, and it all stacks up against Erudio.

gardenia101

[FONT=&quot]I had the reply below from Noddle when I queried how having deferred loans reported by Erudio may work. Not sure what to make of their reply but here it is -
[/FONT]
[FONT=&quot]I can confirm that Erudio aren’t supplying your student loan information to us now, however I have no way of saying whether they will begin to do this in the future. Similarly, I don’t know how they will choose to report on deferred payments – if Erudio have told you they will do this, then it’s most likely to be the case.[/FONT]

[FONT=&quot]When you say that you understand payment holidays as [/FONT][FONT=&quot]breaks in repayments and they do not suggest to others viewing my file that the loans do not have to repaid, you are correct. Any lender viewing your file, if it does show ‘payment holiday’ in the future, will know what this means.[/FONT]

[FONT=&quot]I’m really sorry I can’t give you a more definite answer, however until the information is on your credit file it’s not possible for me to know how it will be displayed.

[FONT=&quot]Sorry, brain not functioning today. Will reread their reply & the last pages of this thread & try harder[FONT=&quot] [/FONT][/FONT]
[/FONT]

anna2007

gardenia101 wrote: »

[FONT=&quot]I had the reply below from Noddle when I queried how having deferred loans reported by Erudio may work. Not sure what to make of their reply but here it is -
[/FONT]
[FONT=&quot]I can confirm that Erudio aren’t supplying your student loan information to us now, however I have no way of saying whether they will begin to do this in the future. Similarly, I don’t know how they will choose to report on deferred payments – if Erudio have told you they will do this, then it’s most likely to be the case.[/FONT]

Noddle/Callcredit are as responsible/liable for the safekeeping of our private data as Erudio - why do they have no !!!!ing clue if Erudio are about to report the loans? Equifax were able to confirm that they're not in discussions about it, and Experian confirmed that they are in discussions about it. Also, it's not solely Erudio's choice about how the loans would be reported - the CRA has to review/agree that the reporting's appropriate.

gardenia101 wrote: »

[FONT=&quot]When you say that you understand payment holidays as [/FONT][FONT=&quot]breaks in repayments and they do not suggest to others viewing my file that the loans do not have to repaid, you are correct. Any lender viewing your file, if it does show ‘payment holiday’ in the future, will know what this means.[/FONT]

If there was a prize in all of this for the most non-committal answer, this has to be a contender, and that's going some with all of the sh!te FOS/ICO have been spouting.

gardenia101 wrote: »

[FONT=&quot]I’m really sorry I can’t give you a more definite answer, however until the information is on your credit file it’s not possible for me to know how it will be displayed.

We're really sorry too that you can't give a definitive answer when that's your job. Strange how the other 2 CRAs were able to give a view on how it would show on the credit file?

anna2007

Here's something that shows clause 16 of the pre-98 agreement that Erudio are relying on isn't legally valid (neither is the way Erudio have been trying to coerce agreement to their FPN, via both the old and new DAF). It's "Opinion 15/2011 on the definition of consent", adopted by the EU advisory body on data protection and privacy in July 2011, which sets out the requirements for consent to be valid under applicable law. My understanding is that the DPA is derived from the EU Directive (95/46/EC), and that EU law trumps the UK legislation (and the opinion of the ICO!).

http://ec.europa.eu/justice/policies/privacy/docs/wpdocs/2011/wp187_en.pdf

Page 4
The goal of the Opinion is to clarify matters to ensure a common understanding of the existing legal framework... After providing an overview of the legislative history and role of consent in data protection legislation, we examine the different elements and requirements for consent to be valid under applicable law.

Page 9
Transparency
To be valid, consent must be informed. This implies that all the necessary information must be given at the moment the consent is requested, and that this should address the substantive aspects of the processing that the consent is intended to legitimise. This would normally cover the elements of information listed in Article 10 of the Directive, but will also depend on when, and the circumstances in which, consent is requested.

Page 35
Specific elements of the legal framework related to consent
For consent to be valid, it must be freely given. This means that there must be no risk of deception, intimidation or significant negative consequences for the data subject if he/she does not consent.

Consent must be specific. Blanket consent without determination of the exact purposes does not meet the threshold. Rather than inserting the information in the general conditions of the contract, this calls for the use of specific consent clauses, separated from the general terms and conditions.

Consent must be informed. Articles 10* and 11 of the Directive lists the type of information that must necessarily be provided to individuals. In any event, the information provided must be sufficient to guarantee that individuals can make well informed decisions about the processing of their personal data. The need for consent to be "informed" translates into two additional requirements. First, the way in which the information is given must ensure the use of appropriate language so that data subjects understand what they are consenting to and for what purposes. This is contextual. The use of overly complicated legal or technical jargon would not meet the requirements of the law. Second, the information provided to users should be clear and sufficiently conspicuous so that users cannot overlook it. The information must be provided directly to individuals. It is not enough for it to be merely available somewhere.

For data other than sensitive data, Article 7(a) requires consent to be unambiguous. "Unambiguous" calls for the use of mechanisms to obtain consent that leave no doubt as to the individual's intention to provide consent. In practical terms, this requirement enables data controllers to use different types of mechanisms to seek consent, ranging from statements to indicate agreement (express consent), to mechanisms that rely on actions that aim at indicating agreement.

* DIRECTIVE 95/46/EC Article 10
Member States shall provide that the controller or his representative must provide a data subject from whom data relating to himself are collected with at least the following information , except where he already has it:

( a ) the identity of the controller and of his representative, if any;

( b ) the purposes of the processing for which the data are intended;

(c ) any further information such as

— the recipients or categories of recipients of the data ,
— whether replies to the questions are obligatory or voluntary, as well as the possible consequences of failure to reply,
— the existence of the right of access to and the right to rectify the data concerning him

in so far as such further information is necessary, having regard to the specific circumstances in which the data are collected, to guarantee fair processing in respect of the data subject.

http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:31995L0046&from=EN