GDRP and credit files

Constantina

under the new GDRP law everybody will have the right to SAR (subject Access Requests) about their personal data and companies cannot charge a fee for them.
Would that work for all the credit agencies like Experian and Equifax that either charge a fee for a report or a subscription?

[Deleted User]

GDPR, not GDRP.

A basic SAR will be free of charge. Any added value or fancily packaged reports could still be charged for. However, you can currently get your reports free from all three.

AstroTurtle

Deleted_User wrote: »

GDPR, not GDRP.

A basic SAR will be free of charge. Any added value or fancily packaged reports could still be charged for. However, you can currently get your reports free from all three.

And also they may just send you the raw data they hold which is basic loan/credit/bank information and not actually send you the Credit Score/Report in the format you are trying to go after.

tenchy

The average credit bureau holds much more data about you than appears in your credit report. Current Account Turnover (CATO) analysis is one such data set. A SAR will flush out all the extra data that doesn't appear on the standard credit report.


I would recommend SARing Equifax to start with. This will give you some indication of the extent of your personal data they've allowed to be hacked.

PixelPound

I wonder if you will get any mass-action requests, a company working on behalf of a lot of people requesting DSAR prior to potential claims. With the (bad) news that equifax has had I wouldn't be surprised if they were targeted with one. You would think big companies are catering for such DOS attacks (time limit to respond so how do they cope for a simultaneous request for 1000's)

[Deleted User]

Indeed, I'm requesting all 3 at the end of May! Of particular interest to me is Equifax, where my 'score' has dropped by over 250 points from UK average to 79 :rotfl:

Had a few searches, but nothing major, particularly compared to Experian. Want to see the raw data they're using to assess that!

Also - just how are they going to deliver all this data? I did a SAR to the insolvency service so that I had proof of discharge etc (as well as the standard email) - it was two great big folders that cost them 6 quid to post.

Will it be electronic delivery from the CRAs, given that most (all?) data should be held electronically!

[Deleted User]

Likely to be electronic to comply with portability requirement. But some companies (not CRAs) may continue with paper, depending on systems.

deletemydata

Hi,

basically with a Subject Access Request the main differences between a SAR request on or after May 25th and before that are:

• It is free (the company can charge an admin cost which mirrors the actual cost but only on very rare occasions)
• Companies will have 28 days to comply and not 40 days as current
• They can send you the response in electronic format (and will prefer to due to postage but only if they can get it all scanned)
• A SAR now covers all data in all formats and this includes opinions as well as facts
• It will cover data on systems, on paper, images, audio files, written notes etc
• It covers the data they have on you and data they have sent too and from third parties (including Social Media)
• It includes all data related to you as a living human being and this includes credit scores, flags, profiling information, demographic scores and profiles etc
• The only personal data it does not cover is that which is withheld for legal privilege, national security etc
• It does not cover dead people
• IWhen you get the SAR back it must also come with explanatory notes of what the data is, who holds it (what companies), if it is held outside the EEA etc

Once you have this information you have a number of additional rights which mean you can:

• If you have given consent e.g. for marketing you can withdraw it
• Most consents given before May 25th are not legal afterwards
• If a company says they have a legitimate interest in keeping and using your data they have to prove it and assess their interests against yours
• You can ask for data to be deleted
• you can ask for data to be modified or updated
• you can ask for then to stop processing some of your data
• you can ask for them to stop processing you altogether
• If any processing (for example Credit profiling) ha been carried out on an automated basis, you can ask for them to not do this and to manually process and consider your case

It really puts people back in charge of their data and having spent 12 months working through the legislation, it is giving me a lot to sort out and it is also looking like it will end in the demise of marketing spam data pool companies.

The fines to any company which does not behave are up to 4% of global turnover and 2% just for not having the right paperwork.

At the end of the day, ask for your SAR and when you get the response, take it from there. If you do not get an adequate response just make a complaint to the ICO and they will really be cracking down on companies