CRAs - how long can they keep your data?

Bazza73

Hi all,

Does anyone know how long a CRA is allowed to retain your data for?

I understand that accounts are kept on file if still open and for 6 years after closure / settlement. But what about old addresses? Experian and Equifax only seem to go back 6 years whereas Call credit lists every address ever listed.

Also, on the electoral role section, my wife is listed yet we have no financial connections anymore (not listed in the financial connections section just the electoral role part). Should others be listed on my file in this way?

Cheers.

fermi

Personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes.

5th Data Protection Principle.

Experian feel that is 8 years from what I recall, and other CRAs may have other takes on a time period. Not one set in law or ICO guidance as far as I've seen?

stclair

I always feel the statement "no longer than necessary" is rather ambiguous.

You could always contact the ICO for guidance:

https://ico.org.uk/global/contact-us/

eroneo

Bazza73 wrote: »

Hi all,

Does anyone know how long a CRA is allowed to retain your data for?

I understand that accounts are kept on file if still open and for 6 years after closure / settlement. But what about old addresses? Experian and Equifax only seem to go back 6 years whereas Call credit lists every address ever listed.

Also, on the electoral role section, my wife is listed yet we have no financial connections anymore (not listed in the financial connections section just the electoral role part). Should others be listed on my file in this way?

Cheers.

How many years old are the call credit addresses?

stclair

eroneo wrote: »

How many years old are the call credit addresses?

Call credit retain linked addresses indefinitely.

Bazza73

eroneo wrote: »

How many years old are the call credit addresses?

They go back 20 years for me.

GingerBob_3

If you assume all the CRAs keep all the data they've ever collected about you for an indefinite period you won't be far off the mark.


The six-year cut-off only applies to the data about you they supply to their customers. It is highly likely that nothing is ever deleted, merely archived after several years beyond the six year period.


As fermi pointed out, the ICO state: "Personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes." This outrageously equivocal statement gives organisations like the CRAs complete discretion as to what they do with data about you.


If you really want to find out what they hold about you, and maybe even for how long, you could hit them with a Subject Access Request (£10 fee payable).