Barclays Bank privacy policy is 10 years out of date!!

GraceCourt

I know that a huge proportion of people don't actually read the "small print", but sometimes it's important. I recently had to launch civil proceedings against a debt recovery company who were demanding that I pay over £300 for a CCJ that wasn't mine… obviously, the District Judge ruled in my favour but it has made me be very careful about what large companies are doing with my personal data.

So when I was rejected for a Barclaycard, having a few years ago had a £14,000 credit limit with American Express, my first stop was the bank's privacy policy, dated 2024. I was astonished to read that it states: "If you’d like to know about the information credit reference agencies hold about you, you should contact them direct (please note, they will charge you a fee for this service)." See https://www.barclays.co.uk/content/dam/barclaycard/documents/personal/Privacy_Policy_terms.pdf.

But Article 12(5) of the UK GDPR - which came into force in 2016 - makes it very clear that a data controller can only charge a fee under very specific circumstances:

Information provided under Articles 13 and 14 and any communication and any actions taken shall be provided free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may either:

(a) charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or

(b) refuse to act on the request.

The controller shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request.

So it would seem that no-one with any knowledge of privacy or data protection laws has looked at the privacy policy for the last ten years! And no, I no longer want a Barclaycard…I contacted them about the above error but they did not respond!

Grumpy_chap

I don't think the Barclays document is incorrect. The CRAs do offer a paid service.

Barclays were referring to data held by the CRAs, not data held by Barclays.

You may find the following worth a read through:

https://www.moneysavingexpert.com/loans/check-free-credit-report/#free

The credit you had from AMEX a few years ago has no bearing on the credit that might be offered to you by Barclaycard today.

GraceCourt

https://forums.moneysavingexpert.com/discussion/comment/81967666#Comment_81967666

The CRAs offer all sorts of paid services, but a Subject Access Request is still free - exactly because the law says it must be. I've just received my TransUnion and Experian credit reports, both free, to ensure that none of them hold inaccurate credit data. A fee of £8 is payable to Registry Trust Ltd. for any record of a CCJ, but that's not the same thing, although I submitted mine to prove to the District Judge that the CCJ in question wasn't mine.

eskbanker

So it would seem that no-one with any knowledge of privacy or data protection laws has looked at the privacy policy for the last ten years!

That's quite a leap from a passing reference to CRAs charging, which (while an error) is essentially peripheral to the main thrust of the document, namely the obligations and liabilities of Barclaycard themselves.

They list an 0844 number for Equifax too, which I imagine won't be in use anymore, but to me that sort of thing is pretty incidental and unremarkable rather than 'astonishing' - to be honest, I'd have expected Barclaycard to simply signpost the names of the CRAs and direct readers to locate the privacy policies of each, but they'd presumably argue that they're trying to be helpful by including more than that.

Jemma01

https://forums.moneysavingexpert.com/discussion/comment/81967682#Comment_81967682

The Bank's statement seems correct to me, if you want your credit record details, get it from the credit record company. If you submit a SAR request to the bank, they will respond with whatever THEY hold about you (subject to any admin fee that applies), not what a 3rd party hold about you.

Privacy statements get updated regularly, they have legal implication.

Jemma01

https://forums.moneysavingexpert.com/discussion/comment/81967797#Comment_81967797

what exactly is wrong with the 0844?

MattMattMattUK

https://forums.moneysavingexpert.com/discussion/comment/81967826#Comment_81967826

Most businesses abandoned 0844 numbers more than a decade ago. Equifax replaced theirs in public facing documents with 0800 and 0333 numbers many years ago, though the old 0844 (which charges) may still exist in the background.

eskbanker

https://forums.moneysavingexpert.com/discussion/comment/81967824#Comment_81967824

The point OP was making is that companies can't charge admin fees for responding to SARs, unless in the exceptional circumstances quoted.

https://forums.moneysavingexpert.com/discussion/comment/81967826#Comment_81967826

About ten years ago, the FCA mandated that financial institutions weren't to use 08nn numbers for customer-facing functions, other than the free ones such as 0800, and to use the more cost-effective (for the consumer) 03nn equivalents instead.

GraceCourt

Just by way of an update, I made a SAR request to Barclays six weeks ago, and although they acknowledged receipt, there has been nothing since.

I'm guessing that they can't cope as a SAR ought to be provided within a month, and as they (still) didn't respond to a "letter before County Court proceedings", sent after the one month allowed for a response by law, I will be issuing a claim for nominal damages under the precedent set by the decision of the Court of Appeal in Halliday v Creation Consumer Finance Limited [2013] EWCA Civ 333 under Section 13(1) and 13(2) Data Protection Act 1998, now repealed and replaced by equivalent provisions in Article 82 of the UK GDPR and Section 168 Data Protection Act 2018.

MyRealNameToo

Given the OP is pointing out the relatively minor error of others saying that CRAs charge from statutory credit report when they havent been able to since GDPR came into force its probably worth also pointing out that it came into force 8 years ago not the 10 years the title says… those in glass houses and all

GraceCourt

https://forums.moneysavingexpert.com/discussion/comment/82008765#Comment_82008765

Actually, although it did come into force 8 years ago, the legislation was passed 10 years ago so that everyone affected was in compliance from day one.