CRAs sharing personal data with utility companies?

HereBeDragons_2

I rang Thames Water today with a query about my account, and was surprised to be asked my date of birth during the security check.

I said as far as I am aware I have never provided TW with this information - I'm very unwilling to disclose it to any utility providers as I see no need for them to have it - and the call handler said they do have a DOB on file and TW may have have obtained it as a result of data sharing with a credit reference agency.

I pressed her more but she couldn't say when it had been put on file, and I was unwilling to confirm my DOB in case it was just a ruse to get it out of me. She assured me if they had obtained my DOB like this it would all have been done above board and in full compliance with the Data Protection Act.

Hmmm. Notwithstanding the growing trend for utility providers to report to CRAs, which I am well aware of, I am very concerned that companies may be obtaining this kind of personal info about customers via CRAs.

Would this kind of data sharing be lawful? I understand that credit providers share our personal info with CRAs in order to identify us and ensure correct reporting, but surely CRAs shouldn't be disclosing additional personal information about us which credit providers/utility companies don't already hold, without our consent?

If the Thames Water call handler was talking rubbish then how could I find out how TW have obtained my DOB? Send a letter requesting information about how and when they obtained it, or would I only find it out by making a full Subject Access Request?

GingerBob_3

I await the opinions of others on this matter, but bear in mind the following:


You have no contract or terms of agreement with either the CRAs or the water company, so you have not agreed for any data about you to be transferred in either direction.

HereBeDragons_2

That's exactly what I thought.

However, Thames Water clearly think otherwise - look here, they do indeed obtain customers' personal info from CRAs:
http://www.thameswater.co.uk/legal/18164.htm

Given what Ginger Bob says, how are utility companies able to do this?

The endless 'mission creep' of companies getting their hands on our sensitive personal data is pretty murky and it annoys me no end.

GingerBob_3

As it happens I am currently liaising with the ICO on this matter. It is interesting to note that TW "have not credit checked you", but that doesn't say they won't attempt to do so in the future.


They key to your relationship with water companies is not providing them with ANY personal data. I was recently of the opinion that the only data you should provide to them is your surname - not even your title. I am now reconsidering; you shouldn't even provide them with your surname. Let them know you as "The Occupier". You may need to pay by standing order to do this.


The garbage they spout about managing your account is just that; garbage! Since they apparently aren't credit checking you, why are they supplying data to the CRAs?


The answer is simple; blackmail. "Pay us what we say, when we say, don't dispute anything or we'll trash your ability to obtain credit". These companies should not be permitted to have anything to do with CRAs. You have no contract with them, so they have not obtained consent.

HereBeDragons_2

Good for you Ginger Bob.

I'd be very interested to know the outcome of your ICO correspondence. I was just browsing the ICO website looking for indications as to how this data sharing is allowable under the DPA, and I think your points are legitimate. It's data harvesting by stealth, all under the auspices of "managing your account accurately".

Keep us posted. People should be worried about the implications of this - it suggests any company with a relationship with a CRA can access and harvest sensitive personal information they have no right to be processing.

GingerBob_3

I'll keep you updated by PM. Likewise, if you follow up on this with SAR to either Thames or the CRAs please let me know how you get on.


To date, I've had a response from the ICO, and a response from my water company trying to justify their actions (they failed!). I await further information from the ICO before deciding on my next step.


Here is some relevant background information from the ICO website:


https://ico.org.uk/for-organisations/guide-to-data-protection/conditions-for-processing/


The water companies appear to be using the "legitimate reason" argument as a justification to data rape their customers.

Redcharge

I'm currently having a terrible time getting a mortgage due to reporting from United Utilities. Please keep me informed of how you get on.

jadex

it is indeed worrying,
but looks like most people are not that concerned judging by the number of post...
I do take my personal data seriously and do not wish any company to have my DOB on file if not provided by me. Also cannot see any legitimate reason for TW to obtain it behind my back.
CRAs shouln't be allowed to exist as private businesses at they always will try to squeeze water from the stone and will invent some unnecessary things.

DCFC79

Redcharge wrote: »

I'm currently having a terrible time getting a mortgage due to reporting from United Utilities. Please keep me informed of how you get on.

So what's on your credit file then that puts mortgage companies off ?

Brock_and_Roll

DCFC79 wrote: »

So what's on your credit file then that puts mortgage companies off ?

Well that's the point isn't it.

On the one hand, as a hater of Big Brother and data mission creep I am loath to give anything other than basic information to utility companies etc, however on the other hand as a consumer I want the best deal possible for my mortgage/loan/gas etc given my perfect payment record and if data sharing allows "bad payers" to be "weeded out" to make prices cheaper for me....

Thus I suspect this is why many of us we reluctantly but tacitly put up with such data sharing.

HereBeDragons_2

GingerBob wrote: »

I'll keep you updated by PM. Likewise, if you follow up on this with SAR to either Thames or the CRAs please let me know how you get on.


To date, I've had a response from the ICO, and a response from my water company trying to justify their actions (they failed!). I await further information from the ICO before deciding on my next step.


Here is some relevant background information from the ICO website:


https://ico.org.uk/for-organisations/guide-to-data-protection/conditions-for-processing/


The water companies appear to be using the "legitimate reason" argument as a justification to data rape their customers.

It sounds like you've had the same happen to you then - your water company have obtained more personal info, via a CRA, than you disclosed when opening your account?

I'll PM you to ask for more details, if that's ok - v interested to know exactly what steps you've taken so far with both CRA and utility company. I'm fully prepared to take this to the ICO.

I take the firm view that it's up to me to disclose my DOB to a company, and that unless I have given specific written consent to another company to do so, then that other company has absolutely no business disclosing any of my personal information just because it's been requested by a company with whom they sometimes share information. Thames Water's request for my DOB should come directly to me (which it never has), not be harvested secretly behind my back.

The fact that these companies have a reason to share data from time to time does not automatically give them the right to do so, and especially when it's highly questionable whether a water account constitutes a credit agreement at all.

I know that for those of us with clean credit histories, who are savvy about keeping abreast of issues with our utility providers so that our credit records aren't trashed when mistakes are made (though that can still happen with alarming ease), the thought of having a few more green ticks on a credit file, or getting a better deal on your utilities is enticing - but it's a rare person who can say they've not had some kind of issue/dispute along the line with either a phone or utility provider at some point. These companies can wreck a credit history at the drop of a hat and there's no price for them to pay if it turns out down the line they were wrong. For us the implications are huge.

MSE forums are littered with sorry tales of people having nightmares for weeks and months on end, trying repeatedly to get utility providers to correct often woeful errors, and it's one of the reasons I refuse to give my DOB out to my power and water companies. They just don't need it in order to set up and operate a utility account. The other reason is that I object to being silently profiled on my credit history by a company when I haven't even applied for credit with them, which it appears is what Thames Water are up to here - it's up to me to opt in to being credit profiled, as and when I have a legitimate need in my eyes for that to happen.

Grrr.