Re passing our info to CRA's - the loan agreement clearly states that any disclosure of information is subject to the provisions of the DPA, which means Erudio needs our explicit consent. Unless Erudio can show that they're exempt from the DPA provisions, we have to challenge their assumption that they can pass on our details without consent.
Just because the SLC decided to start reporting defaulted loans to CRA's in 2009 (which probably still fell foul of the DPA requirements) does not mean Erudio has the right to report deferred loans. On Erudio's website, they are very careful in their wording on this, it doesn't actually say that they're entitled to report loans in deferment:
"Is this a change in my agreement, I didn’t think the Student Loans Company did this previously?
No, your agreement is not changing. The owner of the loans has always been permitted to use credit reference agencies (CRAs) for the purposes of data validation. The Student Loans Company has registered defaults with CRAs and the terms and conditions have always permitted the Student Loans Company to share data in the way detailed above. Erudio Student Loans will be processing and managing student loans on a system which will use and register the data in a manner which facilitates data validation and supports responsible lending and borrowing".
The only justification given here for reporting the loans (rather than doing a search on a credit file for the purposes of data validation) is because Erudio is such an ethical business, they want to promote responsible lending and borrowing. Nothing to do with trashing your credit file when they insist repayments are due on the loans (even though they're not).
Erudio has only bought the old mortgage style loans, so why bother trying to sneak DPA consent into the application form if they're entitled to report deferred loans anyway?
I don't believe Erudio is allowed to disclose my data without my say so, but it's not for me or Erudio to decide who's right and who's wrong, that's one for the FOS or ICO - so please don't just accept it, challenge Erudio in your formal complaint, then take it to the FOS and/or the ICO for an independent ruling.