First Direct - HSBC Memory

funkycredit

So it appears that FD go back 20+ years, in relation to their memory of keeping data. 

I closed my FD account before y2k and it was all paid / all good etc and just moved banks through choice. 

Now, when I apply I'm met with this email which pretty much tells me it's internal records they're relying on - not the CRA info. 

Oh well - least we know their memory is longer than most. 

I'm not overly bothered, just slightly curious what info they think they have so SAR will be sent today me thinks. With a clear instruction to cease processing my data. After 20 years there's no legal (or otherwise) reason for my data to be there. 

Anyway - thought I'd share as I've seen a few posts about HSBC / FD in this regard! 

Sandtree

Their introductory offers are once in a lifetime which will give them a business basis for retaining at least some data to prevent people getting the offer twice 

funkycredit

I'm not / have never had an/y offers. So it's irrelevant in this case.

Theres no current offer anyway, other than the leave offer but that doesn't allow retaining data for +20 years. 

Speedbird676

I opened an HSBC Premier account in branch earlier this year and they still had all my details from a student account I held with them circa 2001. I can even see the secure message I sent them to close it in my online banking.

I haven't held any HSBC accounts between then and now.

stclair

I would challenge that surly they shouldn't be keeping information that long. It might also be worth be worth speaking to the ico about the matter.

colsten

stclair said:

I would challenge that surly they shouldn't be keeping information that long. It might also be worth be worth speaking to the ico about the matter.

There is no maximum time limit. Any company can keep records for as long as they have a business need for it. It appears that FD/HSBC deem it necessary for their business to know whether anyone ever had an account with them. You may disagree with this, but it is their business and they can decide what their business needs are. 

https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/principles/storage-limitation/

born_again

funkycredit said:

I'm not / have never had an/y offers. So it's irrelevant in this case.

Theres no current offer anyway, other than the leave offer but that doesn't allow retaining data for +20 years. 

A business can keep data for as log as they like. So long as it is kept in a secure & data compliant way.

funkycredit

born_again said:

funkycredit said:

I'm not / have never had an/y offers. So it's irrelevant in this case.

Theres no current offer anyway, other than the leave offer but that doesn't allow retaining data for +20 years. 

A business can keep data for as log as they like. So long as it is kept in a secure & data compliant way.

They must have a legitimate reason for retaining it. I'll request full removal and then fight it anyway as it's not allowed, contrary to your beliefs. 

What reason, some +20 years later do they have to hold my data which, out of interest, is 100% incorrect now. Well, other than my name & date of birth everything has changed. 

I'll take it up with HSBC & the ICO. 

funkycredit

colsten said:

stclair said:

I would challenge that surly they shouldn't be keeping information that long. It might also be worth be worth speaking to the ico about the matter.

There is no maximum time limit. Any company can keep records for as long as they have a business need for it. It appears that FD/HSBC deem it necessary for their business to know whether anyone ever had an account with them. You may disagree with this, but it is their business and they can decide what their business needs are. 

https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/principles/storage-limitation/

Within reason. As I've just said, 20 years later when there were no defaults / negative elements does not come under any lawful business need for retention. It's their business, agreed. But it's my data. 

Anyway, wasn't trying to discuss the rights and wrongs of it. Was just highlighting that they do keep historic data and they rely on it heavier than any automated decision; clearly! 

[Deleted User]

funkycredit said:

colsten said:

stclair said:

I would challenge that surly they shouldn't be keeping information that long. It might also be worth be worth speaking to the ico about the matter.

There is no maximum time limit. Any company can keep records for as long as they have a business need for it. It appears that FD/HSBC deem it necessary for their business to know whether anyone ever had an account with them. You may disagree with this, but it is their business and they can decide what their business needs are. 

https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/principles/storage-limitation/

Was just highlighting that they do keep historic data and they rely on it heavier than any automated decision; clearly! 

It's not that they rely 'heavier' on it than an automated decision.  It's all part of their automated decisioning, but doing it that way round saves going to the trouble (for you and them) of a CRA search if they've already checked you against internal criteria.

YorkshireBoy

Deleted_User said:

funkycredit said:

colsten said:

stclair said:

I would challenge that surly they shouldn't be keeping information that long. It might also be worth be worth speaking to the ico about the matter.

There is no maximum time limit. Any company can keep records for as long as they have a business need for it. It appears that FD/HSBC deem it necessary for their business to know whether anyone ever had an account with them. You may disagree with this, but it is their business and they can decide what their business needs are. 

https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/principles/storage-limitation/

Was just highlighting that they do keep historic data and they rely on it heavier than any automated decision; clearly! 

It's not that they rely 'heavier' on it than an automated decision.  It's all part of their automated decisioning, but doing it that way round saves going to the trouble (for you and them) of a CRA search if they've already checked you against internal criteria.

It could be any number of things:

Past/current dealings with others in the HSBC group, eg open accounts, blag incentive, and then leave.
A mistake on the application form (eg entering a monthly income when an annual one was requested).

When I re-joined* FD just under a couple of years ago they wouldn't let me apply online as I was a previous customer many years ago (maybe 8-10?). I had to apply via telephone instead. Maybe their systems have now changed in that they automatically decline on a policy rule but simply don't tell the customer to call instead.

* I also slipped through their net and bagged another joining incentive.