GDPR - sent letter to account inactive 20+ years - advice

all the stars

Good evening,

Im curious about the can of GDPR worms.

A letter from the Credit Union arrived here a few days ago for a person who has had no contact in 20+ years, is a widely publicised missing person and this is a local CU where they would know the family involved.

Can they even contact you after that long?
I thought GDPR meant you couldn’t contact people who were not active customers? Is this a breach?

As I understand it, you cant close an account in CU or bank without death cert, is that right? So no way to stop it?

Thanks!

nuac

Credit Unions hold an AGM each year, usually around December.

A notice of the AGM would have issued to member's last known address

If such notices have been going out to an address for years without any reaction or movement of the account, best practice would be for the Supervisory Committee or auditor to make some enquiries.

Suggest you contact the CU

all the stars

nuac wrote: »

Credit Unions hold an AGM each year, usually around December.

A notice of the AGM would have issued to member's last known address

If such notices have been going out to an address for years without any reaction or movement of the account, best practice would be for the Supervisory Committee or auditor to make some enquiries.

Suggest you contact the CU

Thank you, last known address is also known to be elsewhere but perhaps at that time it hadn’t been changed to the temporary dwelling.

I would imagine this CU account would have been tried to be closed as i know the bank refused to close bank account, im sure it was looked into.
I appreciate your feedback thank you 😊

uck51js9zml2yt

What data was breached?

They wrote to a member at his last known address.

Just inform them and they should be able to put a note in the system.

all the stars

Joy Hundreds Nosebleed wrote: »

What data was breached?

They wrote to a member at his last known address.

Just inform them and they should be able to put a note in the system.

Thats why i was asking - from what i had been told you cant contact customers without expressed consent. If you haven’t had that in 20+ years, thats why i was wondering.

Lekrub

Any business can contact their customers unless you advise otherwise.

all the stars

Lekrub wrote: »

Any business can contact their customers unless you advise otherwise.

Really? In the wake of gdpr deadlines it was publicised that some big companies deleted their contact list- that’s interesting.

odyssey06

Lekrub wrote: »

Any business can contact their customers unless you advise otherwise.

You arent a customer if your account is inactive.

angel eyes 2012

all the stars wrote: »

Thats why i was asking - from what i had been told you cant contact customers without expressed consent. If you haven’t had that in 20+ years, thats why i was wondering.

I'm not sure what the exact concern is here. Consent is the last lawful basis that organisations should rely on, in relation to contacting consumers. Businesses can rely on legitimate interest as a lawful basis for processing data even in relation to inactive customers. Article 6 of the GDPR applies.

They may even be fulfilling some regulatory requirement or legal obligation in relation to trying to make contact with the person.

However, technically opening someone's post without their consent contravenes s.84 of the Postal and Telecommunications Services Act, 1983. That may be more of an issue but I'm open to correction on that point.

Definitely no breach though regarding the GDPR or the Data Protection Act.

all the stars

odyssey06 wrote: »

You arent a customer if your account is inactive.

When is it inactive?

all the stars

angel eyes 2012 wrote: »

I'm not sure what the exact concern is here. Consent is the last lawful basis that organisations should rely on, in relation to contacting consumers. Businesses can rely on legitimate basis as a lawful basis for processing data even in relation to inactive customers. Article 6 of the GDPR applies.

They may even be fulfilling some regulatory requirement or legal obligation in relation to trying to make contact with the person.

However, technically opening someone's post without their consent contravenes s.84 of the Postal and Telecommunications Services Act, 1983. That may be more of an issue but I'm open to correction on that point.

Definitely no breach though in relation to the GDPR or the Data Protection Act.

Yes, correct it was asking for proof of id, and labelled urgent which gave rise to concern. Given this person is missing 20 years, family opened the letter. You have to know who to contact to fix it, no fetails were external on the envelope.

Sleeper12

all the stars wrote:

Can they even contact you after that long? I thought GDPR meant you couldn’t contact people who were not active customers? Is this a breach?

GDPR legislation ensures that your data won't be used for purposes not originally intended for. Obviously banks use your information to post out account details & changes. So sending out a letter is not a breach

Let's say this person had 50k in shares & has passed away. By sending out the letter they are notifying the family that there is an account there. Sending out the letter is a good thing

Sleeper12

all the stars wrote:

Thats why i was asking - from what i had been told you cant contact customers without expressed consent. If you haven’t had that in 20+ years, thats why i was wondering.

This is nonsense. I wouldn't take any more advice from whoever told you that.

odyssey06 wrote:

You arent a customer if your account is inactive.

If your account has money /shares or owes money then it can't be inactive or can it?

sexmag

all the stars wrote: »

Really? In the wake of gdpr deadlines it was publicised that some big companies deleted their contact list- that’s interesting.

That's because they were stupid and literraly had no idea what gdpr was. It's afforded everyone the same rights they already had under the data protection act bar a few tweaks.

With the op unless the CU have been legally informed the person who owns the account is either deceased or incapacitated and provided evidence of such the acc will remain active.

Being legally declared missing does not constitute a legal requirement to cease an active CU account, especially if there are funds in it, based on this they have every right to issue correspondence in accordance with their members last known address and contact preferences

all the stars

sexmag wrote: »

That's because they were stupid and literraly had no idea what gdpr was. It's afforded everyone the same rights they already had under the data protection act bar a few tweaks.

With the op unless the CU have been legally informed the person who owns the account is either deceased or incapacitated and provided evidence of such the acc will remain active.

Being legally declared missing does not constitute a legal requirement to cease an active CU account, especially if there are funds in it, based on this they have every right to issue correspondence in accordance with their members last known address and contact preferences

Thank you. I get it now - appreciate your reply.

sexmag

all the stars wrote: »

Thank you. I get it now - appreciate your reply.

Glad I can help and wish you and your family all the best,I'm sure situations like this are troublesome but in my opinion the CU are acting within the law.

In saying that there's nothing stopping you contacting a solicitor to find a way around certain things if possible.

Good night

odyssey06

Sleeper12 wrote: »

If your account has money /shares or owes money then it can't be inactive or can it?

Down the line it would eventually come under the remit of dormant accounts:
http://www.citizensinformation.ie/en/money_and_tax/personal_finance/financial_institutions/dormant_bank_accounts_in_ireland.html

Sleeper12

odyssey06 wrote:

Down the line it would eventually come under the remit of dormant accounts:

Yes it would. I had the pleasure of the government stealing the contents of a building society account.

This is my point though. Isn't a good thing that they reach out now, assuming there is money in the account, bef it becomes a dormant account. My building society didn't reach out to me before my money was stolen.

odyssey06

Sleeper12 wrote: »

Yes it would. I had the pleasure of the government stealing the contents of a building society account.
This is my point though. Isn't a good thing that they reach out now, assuming there is money in the account, bef it becomes a dormant account. My building society didn't reach out to me before my money was stolen.

As long as it is part of that process yes. But if 20 years has already past it should be dormant already. If there's been no activity on the account in all that time to be sending out statement type letters is bad data handling.

Sleeper12

odyssey06 wrote: »

As long as it is part of that process yes. But if 20 years has already past it should be dormant already. If there's been no activity on the account in all that time to be sending out statement type letters is bad data handling.

Does dormant account cover credit union? You don't save money there you buy shares. I don't know the answer to that question but I thought owning shares might be treated differently

odyssey06

Sleeper12 wrote: »

Does dormant account cover credit union? You don't save money there you buy shares. I don't know the answer to that question but I thought owning shares might be treated differently

Actually, the dormant account legislation from the 2000s exempted credit union accounts from fund seizure by the state - on the expectation that the funds would be used by the credit union after same amount of dormancy.

But after 3 years without any customer generated transactions, the account should have been flagged as inactive and a notification sent to the customer:
http://www.mpcccreditunion.ie/savings/dormant-accounts/

At that point, it seems strange to me to continue sending out annual statements. If the account has been marked as inactive, that should be a flag to the CU that it should not notified as per an active account.

L1011

As they're a shareholder rather than a customer as such would that not remove some of the restrictions?

Still not worth sending anything out to but with all the mergers of credit unions recently many have been contacting lapsed customers who may have left due to how badly run their former CU was.

Grab All Association

It’s never easy I’d imagine getting letters like this but you have to be prepared for it unfortunately. Credit unions/banks etc are sometimes required to send these things.

nuac

odyssey06 wrote: »

Down the line it would eventually come under the remit of dormant accounts:
http://www.citizensinformation.ie/en/money_and_tax/personal_finance/financial_institutions/dormant_bank_accounts_in_ireland.html

The Dormant Accounts procedure does not apply to Credit Unions.

Most Credit Unions are locally based co-ops or vocational groups. Their directors and staff are closer to the membership

blackwhite

all the stars wrote: »

Really? In the wake of gdpr deadlines it was publicised that some big companies deleted their contact list- that’s interesting.

Marketing lists are not the same of lists of customers.

If someone still has an account with the credit union, and there’s a balance on it, then the credit union is within their rights to both continue to hold the necessary personal information, and to also contact their customer if they deem it necessary