The legality of a water company sharing your data with a CRA when you've never signed a contract

TurningANewLeaf

!!! wrote: »

You don’t have a credit rating - so there’s little point trying to fix something that doesn’t exist.

There’s plenty of other ways to trace people down - a simple google search will yield the answers.

Repairing my credit report then, you knew what I meant and no one likes a pedant!


And as for tracing people, and other ways... such as? Hiring a PI, I don't think my water company would go to those extremes (or anyone else I used to owe money to).

PixelPound

The water company could well have got your name from the landlord, a otherwise the landlord would have been liable. There will be info on OfWat about it, and I assume its similar to OfGem for energy where adults living at the property can be deemed liable. GDPR won't get you out of it, you can't ask for your details to be erased so you don't owe any debt.

Your comment on what's the point of GDPR - I remember at the time but there were companies who used your info in several ways that when GDPR came in simply gave a verbose statement saying by continue to use the service you accepted they could carry on using your data in these ways and the only way to opt out was to stop using it by a certain date - it applied to some big email companies and the like who offer you a "free service" but make money of your data.

PixelPound

TurningANewLeaf wrote: »

Repairing my credit report then, you knew what I meant and no one likes a pedant!


And as for tracing people, and other ways... such as? Hiring a PI, I don't think my water company would go to those extremes (or anyone else I used to owe money to).

Facebook, google, or relatives using social media, browsing the web etc. Services used by heir hunters and family historians, etc. The water company might not but they could employ a debt collector who may use other services.

TurningANewLeaf

nic_c wrote: »

Facebook, google, or relatives using social media, browsing the web etc. Services used by heir hunters and family historians, etc. The water company might not but they could employ a debt collector who may use other services.

I'm not in the habit of dishing out my new (or old) addresses to social media sites willy nilly.



I doubt even a PI could have found me back then, not unless they have insiders working at the council, or they rang up every letting agent company in the country fishing for info. The only other way is if the letting agents or council sell my data and it ends up on some kind of database.


I mean I'd be a lot easier to find today, but then I'm not hiding from anything today, it's difficult to find someone who doesn't want to be found, even today.

[Deleted User]

TurningANewLeaf wrote: »

Although my next question is what the hell is the point in the GDPR laws, apart from having to make you tick annoying boxes when you visit a new site, if you can do whatever you want with the data anyway with a small disclaimer?

The point of GDPR is to protect your privacy and ensure that anybody storing and processing your has a legitimate reason to do so. There are 6 different lawful basis for an organisation to store and process your data - only one of them requires your consent:

• Consent
• Contract
• Legal Obligation
• Vital interests
• Public task
• Legitimate interest

In certain circumstances, organisations don't need to rely on your consent. For example the police do not need your consent to store your criminal record otherwise things would get messy very quickly so they use "Legal Obligation". The NHS don't need your consent to store and process your data when you visit A&E unconscious, they use "Vital Interests" otherwise treatment would be difficult.

Likewise a water company does not have to rely on your consent to store and process your data because they use what is known as "legal obligations" and "legitimate interests". They have a legal obligation to supply you with water and therefore can use data received by any means in fulfilling that obligation. They have a legitimate interest to manage your account and bill you so don't need your consent to do that, including checking and sharing information with a CRA.

Read the privacy policy for your water company and it should explain this in full.

You will find that a water company will need your consent to store extra information about your health and well being if for example you request a social tariff based on health or financial reasons or different operational circumstances to suit your needs.

So in short, the water company have done nothing illegal.

TurningANewLeaf

[Deleted User] wrote:

The point of GDPR is to protect your privacy and ensure that anybody storing and processing your has a legitimate reason to do so. There are 6 different lawful basis for an organisation to store and process your data - only one of them requires your consent:

• Consent
• Contract
• Legal Obligation
• Vital interests
• Public task
• Legitimate interest

Certain circumstances doesn't rely on your consent. For example the police do not need your consent to store your criminal record otherwise things would get messy very quickly so they use "Legal Obligation". The NHS don't need your consent to store your data when you visit A&E unconscious, they use "Vital Interests"

Likewise a water company does not have to rely on your consent to store and process your data because they use what is known as "legal obligations" and "legitimate interests". They have a legal obligation to supply you water and therefore can use data received by any means in fulfilling that obligation. They have a legitimate interest to manage your account and bill you so don't need your consent to do that, including checking and sharing information with a CRA.

Read the privacy policy for your water company and it should explain this in full.

You will find that a water company will need your consent to store extra information about your health and well being if for example you request a social tariff based health or financial reasons or different operational circumstances to suit your needs.

So in short, the water company have done nothing illegal.

That's interesting, thanks!


My counterpoint, if we were thrashing this out in court, is while they may have a legal obligation to provide my property with water, they don't have a legal obligation to record my name. Granted, they have a legitimate interest in recording my name and address, and if we are being generous, we can even say they have a legitimate interest in passing on my lack of payments or defaults to a CRA, because it kind of acts as a deterrent against me simply not paying.



But here is where it gets interesting, I also have the right to erasure 'right to be forgotten' without undue delay under certain circumstances such as (section 3 article 17 1a)), when the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed


https://eur-lex.europa.eu/legal-content/EN/TXT/?qid=1528874672298&uri=CELEX:02016R0679-20160504

So let's assume, I have a default with the water company, and have made a bunch of late payments too, but then I repay them in full and close the account and move house. There is no longer a legitimate interest in the water company keeping this data about me. They've been paid in full, the account is closed. So I have the right to ask them to erase that information without undue delay which they are obligated to do under GDPR.


But what about the CRA they passed that information to I hear you ask, surely they still have a legitimate interest in that data? Well here's the thing, maybe they do, maybe they don't, but one thing they must do is ensure their data is accurate, so when I ring them up and question why that default and late payments are on my credit file, they might well turn round and say "well that's the data the water company provided us with".


BUT


I've already successfully managed to get the water company to erase that data under my right to be forgotten without undue delay. So when I tell the CRA "maybe you better double check with the water company that data is accurate", they then contact the water company, who no longer have any records, and my friends at the CRA are forced to delete their records too.


I think you call that, Game, Set, Match me :cool:


Anyone else need any loopholes give me a shout.

[Deleted User]

Oh dear.
You’re one of those.

Unfortunately that’s not how it works.

Financial information and data they are obligated to keep for 6 years minimum, and that includes any data that goes along side it - your name, address, email etc etc.

They can remove your data from other things - marketing, mailshots, customer lists.

But not financial information.

As already stated - it’s not a get out of jail free card.

TurningANewLeaf

!!! wrote: »

Oh dear.
You’re one of those.

Unfortunately that’s not how it works.

Financial information and data they are obligated to keep for 6 years minimum, and that includes any data that goes along side it - your name, address, email etc etc.

They can remove your data from other things - marketing, mailshots, customer lists.

But not financial information.

As already stated - it’s not a get out of jail free card.

Fair point Gary, let's assume you are correct for a moment and I can't get the water company to erase that information they have on me, as they're obligated to hold onto it for 6 years.


Okay, but they still need a legitimate interest to share that information. So yes, we can argue while I owed the money they had a legitimate interest in sharing that data with a third party, debt collection agencies or a CRA. But what about when I've paid it off? That legitimate interest no longer exists to share that information. But, I hear you say "they've already shared that information with the CRA, the damage is done".


BUT


When I question the data the CRA are holding on me, and they then look into it and ask the water company that the data they hold on me is accurate, the water company no longer have a legitimate interest in sharing that data, there is no legal basis for them at this point to legitimately confirm or deny or share or communicate any data about me with a CRA the moment that debt is paid and account closed, so the CRA will not have a leg to stand on when it comes to keeping that information on me when their source (the water company) can no longer back up what they originally claimed.

[Deleted User]

TurningANewLeaf wrote: »

My counterpoint, if we were thrashing this out in court, is while they may have a legal obligation to provide my property with water, they don't have a legal obligation to record my name. Granted, they have a legitimate interest in recording my name and address, and if we are being generous, we can even say they have a legitimate interest in passing on my lack of payments or defaults to a CRA, because it kind of acts as a deterrent against me simply not paying.

I said read the privacy policy for your water supplier, clearly you haven't otherwise you would have seen the following or something similar which prove they have a legal obligation to store your name:

These activities are regulated by OFWAT who require us to keep reliable, accurate and up-to-date records of customers’ details as well as any interactions with them related to these regulated services.

TurningANewLeaf wrote: »

But here is where it gets interesting, I also have the right to erasure 'right to be forgotten' without undue delay under certain circumstances such as (section 3 article 17 1a)), when the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed

Again, did you bother to read the privacy policy of your water supplier?

We will not keep your personal data longer than is necessary. The law and our regulatory requirements determine the length of time information has to be kept.

You will find a statement like the above which overrides your right to erasure, in the same way the police won't erase a criminal record under GDPR rules.

TurningANewLeaf wrote: »

I've already successfully managed to get the water company to erase that data under my right to be forgotten without undue delay. So when I tell the CRA "maybe you better double check with the water company that data is accurate", they then contact the water company, who no longer have any records, and my friends at the CRA are forced to delete their records too.

No you haven't successfully managed to get the water company to erase your data so all the above is invalid.

TurningANewLeaf wrote: »

I think you call that, Game, Set, Match me :cool:

Anyone else need any loopholes give me a shout.

I think you'll benefit from reading the privacy policy of any organisation you have interactions with before making a fool of yourself in court by quoting random bits of GDPR and claiming loopholes.

LABMAN

The new leaf has curled up and passed away it appears.