Data protection request

sird · 12-01-2015 9:46pm #1

I wonder if anyone can advise why a company can reject the below Data request on the grounds that it can only be processed on their forms / stationary?

18th December 2014

Re Account ********** Complaint ***********

To whom it may concernI wish to make a request for the following information relating to my Account ****** under section 4 of the Data Protection Acts 1988 and 2003. Please find attached a Postal Order for 6.50 to cover any fee.

Firstly I request a record of all calls betwenn myself and UPC (time and dates) between 1st July 2012 and 18th December 2014. The majority of these calls would have been made to / from **********

This is requested because there is a differencebetween my own recordsand notes, the amount, dates and content of this communication as claimed by UPC.

Secondly either transcripts or digial copies of said calls.

Thirdly I request a copy of all notes made by UPC employees on my file, and a copy of all information held about me and my account on UPC systems, including any internal communications /emails referencing me or my account.I also request a copy of all corespondance sent to either my home addresses of **************** (former) and *************** (current) or to my personel email ***********

Lastely I request that the names and / or employee number/ shortcodes be supplied which each entry as applicable.This request has been hand delivered to your office on18/12//14. Taking into account of the maximum 40 days to provide this information by legislation I expec to recieve this information by 28th January at the latest.

Mr. Incognito · 12-01-2015 10:30pm

You can request this by email and cc the data protection office.

sird · 12-01-2015 10:38pm

Mr. Incognito wrote: »

You can request this by email and cc the data protection office.

Their argument is that " as a very large amount of data was requested the form" was requested. I pointed out the legislation and was still told that the form was required.

I asked for an email address so I could resend it and cc the Data Protection Commissioner as you stated and was told no such email address existed in UPC. They only take requets in writting

MarkAnthony · 12-01-2015 10:47pm

CC predates email by a very long way.

Dr.Teeth · 12-01-2015 10:52pm

MarkAnthony wrote: »

CC predates email by a very long way.

To be more helpful than been smart-assed , I think the best is to write a letter to them and also tell them you have also photocopied the request letter and intent on sending it to the Data Protection Commissioner if they do not comply.

MarkAnthony · 12-01-2015 10:57pm

Dr.Teeth wrote: »

To be more helpful than been smart-assed , I think the best is to write a letter to them and also tell them you have also photocopied the request letter and intent on sending it to the Data Protection Commissioner if they do not comply.

Sorry I didn't think the OP needed to be treated like a moron and would know what CC meant.

AnCatDubh · 12-01-2015 11:37pm

sird wrote: »

I wonder if anyone can advise why a company can reject the below Data request on the grounds that it can only be processed on their forms / stationary?

Basically, they shouldn't be and are inviting a whole lot of trouble on themselves. You have actually used the format suggested by the office of the data protection commissioner.

from the data protection commissioners website

What if an organisation refuses to respond to my access request?

If an organisation does not comply with a valid access request that you have made, it is open to you to make a complaint to the Data Protection Commissioner. Before doing so it is recommended that you contact the organisation in question to establish the circumstances and to indicate your intention to complain to this Office. They may be in a position to apologise and correct the problem there and then. We find that this can work well as an organisation once contacted by ourselves will often go through a formal process and actually slow down the resolution of your complaint. If you are not satisfied with their response, or if you do not receive a response, at that point you should make a formal complaint to this office. The Commissioner will investigate the matter for you and ensure that your rights are fully upheld. The Commissioner has wide powers to investigate complaints made to him and will take appropriate action against any persons or organisations that are not complying with the provisions of the Acts.

As they say indicate to the organisation concerned that you intend to complain to the data protection commissioners office and see if they care. If they don't then proceed to contact the office of the data protection commissioner. They are really nice people in the data protection commissioner's office and they have it in their interest, their purpose actually, to ensure your rights are upheld.

The organisation concerned may not have the information that you are seeking and if so, then they simply tell you as such, but if they have it in either digital or manual form, they MUST give you a copy. It is your right established in law.

Lastely I request that the names and / or employee number/ shortcodes be supplied which each entry as applicable.

They may not give you this or redact such information from the records that are forwarded to you. Under data protection you are entitled to your personal data only and information such as staff numbers or employee names aren't [necessarily] your information (they can be in some circumstances, but i doubt it in the one which you outline). Personal data is defined [in the acts] as;

"personal data" means data relating to a living individual who is or can be identified either from the data or from the data in conjunction with other information that is in, or is likely to come into, the possession of the data controller;

Stick to your guns. Data protection is there for you as a citizen and applies to all organisations - they are a data controller and they are responsible to respond to you. If they don't/won't then your recourse is through the office of the data protection commissioner.

Hope that helps.

(the above is legal discussion obviously and not advice per se - thanks)

sird · 12-01-2015 11:38pm

Dr.Teeth wrote:

To be more helpful than been smart-assed , I think the best is to write a letter to them and also tell them you have also photocopied the request letter and intent on sending it to the Data Protection Commissioner if they do not comply.

I have told UPC that I will go to the Data Protection Commissioner but they dont care. I just get the same response that the team has decided that IN THIS case they require the information on their paper work.

The argument they give is because of the size of data I have requested they will not except a written request.

Unfortunately this is a time sensitive issue as I have to prove I was not in arrears for fitness and prohibity for work.

They owed me several hundred euros for several years. They refused to repay it and refused to cancel my account. They locked out my account for payments, approached my bank account for months for payments which were bounced back by them as unpaid. Reported this as unpaid arrears and only when my "arrears" was the same as the money they owed me did they reopen access to my account.

I have NEVER owed them money but complaint after complaint has been unanswered.

I need access to my account so I can clear my name.

Now they keep putting as far as I can see more hurdles in my way.

MarkAnthony · 12-01-2015 11:41pm

sird wrote: »

Unfortunately this is a time sensitive issue as I have to prove I was not in arrears for fitness and prohibity for work.

Out of interest how have work/prospective employer found out about this?

It might be worth consulting a solicitor about threatening defamation proceedings, if appropriate. You may find they are in a position to issue an apology that might be enough for your purposes.

sird · 12-01-2015 11:43pm

AnCatDubh wrote:

Stick to your guns. Data protection is there for you as a citizen and applies to all organisations - they are a data controller and they are responsible to respond to you. If they don't/won't then your recourse is through the office of the data protection commissioner.

Thanks for this. I'm starting to feel so frustrated and your post really helps

sird · 12-01-2015 11:44pm

MarkAnthony wrote:

Sorry I didn't think the OP needed to be treated like a moron and would know what CC meant.

Thanks man I knew what you meant â˜º

AnCatDubh · 12-01-2015 11:45pm

sird wrote: »

I have told UPC that I will go to the Data Protection Commissioner but they dont care. I just get the same response that the team has decided that IN THIS case they require the information on their paper work.

If they are saying that then they are incorrect.

If they don't play ball, actaully make the move and contact the data protection commissioner. That's [part of] what they are there for.

Unfortunately if things are time sensitive with you, it may take a while for the data protection commissioner to investigate and respond, or at best they might just put a rocket under the organisation.

12-01-2015 11:50pm

MarkAnthony wrote: »

Out of interest how have work/prospective employer found out about this?

It might be worth consulting a solicitor about threatening defamation proceedings, if appropriate. You may find they are in a position to issue an apology that might be enough for your purposes.

I'm curious, where do you see publication to a third party?

MarkAnthony · 12-01-2015 11:55pm

234 wrote: »

I'm curious, where do you see publication to a third party?

That was part of my question and qualified response to the OP to be fair.

sird · 13-01-2015 12:00am

MarkAnthony wrote:

Out of interest how have work/prospective employer found out about this?

MarkAnthony wrote:

It might be worth consulting a solicitor about threatening defamation proceedings, if appropriate. You may find they are in a position to issue an apology that might be enough for your purposes.

I had to submit bank statements with the arrears and had a credit checks done when I took up my current job. The arrears were reported to credit bureaus.
I was able to explain it away at the time, but was told I had to prove it as a condition of my probation. I've been asking for a written apology since June, but although promised I have not received any thing.

I have made formal complaints, that either have either not been replied to or didn't admit anything.

I may have to go down the legal route but if I lose my job in the mean time or get removed from a Controlled Function my career will be set back years

Mr. Incognito · 13-01-2015 12:08am

I think you need to contact a solicitor pronto. A solicitors letter now could save your job

AnCatDubh · 13-01-2015 12:18am

sird wrote: »

I had to submit bank statements with the arrears and had a credit checks done when I took up my current job. The arrears were reported to credit bureaus.
I was able to explain it away at the time, but was told I had to prove it as a condition of my probation. I've been asking for a written apology since June, but although promised I have not received any thing.

I don't know if it would assist (it should) but you also have a right under data protection to have incorrect information rectified or removed outright. Data protection is really powerful when it comes to any data held which is correct or incorrect. Apart from UPC, you are likely to need to do something with the Irish Credit Bureau to get that information corrected or removed as may be appropriate.

See a guide to your rights on the ODPC website

Particularly -

5. Right to change or remove your details

If you discover that a data controller has details about you that are not factually correct, you can ask them to change or, in some cases, remove these details.

Similarly, if you feel that the organisation or person does not have a valid reason for holding your personal details or that they have taken these details in an unfair way, you can ask them to change or remove these details.

In both cases, you can write to the organisation or person, explaining your concerns or outlining which details are incorrect. Within 40 days, the organisation must do as you ask or explain why they will not do so.

(Emphasis added above)

You are likely to have to offer proof of them being incorrect but that is, I gather, what you are trying to establish with the information contained in your opening post.

I may have to go down the legal route but if I lose my job in the mean time or get removed from a Controlled Function my career will be set back years

You will get an acknowledgement from the ODPC of your complaint against the third party. Perhaps your employer would be understanding and accept your bone fides that you in good faith are trying your best to sort this out - that you are not at fault, and give an undertaking to keep your employer appraised of progress with the investigation of the ODPC.

Also, explain the constraints in time and the situation with your employment to the ODPC and the threat which is on your continued employment as a result of incorrect data held on the files of third party organisations - they are likely to take this into account.

Hope it works out for you. Sounds crappy to be caught in this particular bind.

sird · 13-01-2015 12:31am

AnCatDubh wrote:

You are likely to have to offer proof of them being incorrect but that is, I gather, what you are trying to establish with the information contained in your opening post.

You're right with out UPC formally admitting anything I felt I had to get proof myself. Your word only counts for so much in today's regulatory environment I needed to get some sort of proof.

AnCatDubh wrote:

You will get an acknowledgement from the ODPC of your complaint against the third party. Perhaps your employer would be understanding and accept your bone fides that you in good faith are trying your best to sort this out - that you are not at fault, and give an undertaking to keep your employer appraised of progress with the investigation of the ODPC.

AnCatDubh wrote:

Also, explain the constraints in time and the situation with your employment to the ODPC and the threat which is on your continued employment as a result of incorrect data held on the files of third party organisations - they are likely to take this into account.

I had no idea I could go down this route. Thankfully I have options now

AnCatDubh wrote:

Hope it works out for you. Sounds crappy to be caught in this particular bind.

You have no idea how stressful this has been, and I am so grateful for your help

MarkAnthony · 13-01-2015 12:36am

sird wrote: »

I had to submit bank statements with the arrears and had a credit checks done when I took up my current job. The arrears were reported to credit bureaus.
I was able to explain it away at the time, but was told I had to prove it as a condition of my probation. I've been asking for a written apology since June, but although promised I have not received any thing.

I have made formal complaints, that either have either not been replied to or didn't admit anything.

I may have to go down the legal route but if I lose my job in the mean time or get removed from a Controlled Function my career will be set back years

I'm still not clear how this was on your bank statement. I was also under the impression the ICB only dealt with bank debts. I could very well be wrong. While it would probably fall under the defence of qualified privilege there may be other avenues available (negligence). I work for a similar type of company and as soon as a solicitor is involved it's taken out of the hand of the day-to-day monkeys (of which I'm one) and given to the shouty man that sits behind me (in house counsel).

I really hope you get sorted OP.

Happdog · 13-01-2015 1:35pm

It may be worthwhile contacting the Irish credit Bureau. You have a right to have any “incorrect” information removed or a comment added explaining the situation. Would your employer accept an updated report with the problem resolved or explained?
How did UPC owe you money and do you have any bill or record detailing the set off arrangement?

From the viewpoint of all parties it would be simpler if UPC could at this stage simply acknowledge that this was the arrangement at the time. I would imagine that this would be discernible from the bill you received at the time and theses should be easily supplied to you by UPC. Have you any documentation that supports or confirms that this was the arrangement? Or any documentation showing how they came to owe you money?

The request currently is very broad and even if supplied will not answer the question in hand, that is, were there non-payments on the account.

whomitconcerns · 13-01-2015 1:40pm

how were the arrears reported to ICB? They only deal with financial institions, etc?

http://www.icb.ie/membership.php

Data protection request

Comments