On the DPA issue - I've had a look at the ICO's guide to Data Protection, copy here:
ico.org.uk/for_organisations/guidance_index/~/media/documents/library/Data_Protection/Practical_application/the_guide_to_data_protection.pdf
It's a requirement of the DPA's fair processing provisions that we're told how an organisation will use our data and who it will be shared with or disclosed to, usually done through a privacy notice or FPN (pages 5-6/130).
S.16 of the loan agreement is not the same as a privacy notice, it's a general term and the only thing we agreed to by signing the agreement is that the SLC may disclose our data, subject to the provisions of the DPA. This is not the same thing as consenting to our information being disclosed, because we haven't been told how the data will be used, or who it will be disclosed to.
If the SLC never issued a privacy notice, then they've been in breach of the DPA all along, and any disclosure of data has not been subject to the provisions of the DPA, so it would be a breach of the loan agreement too (if they disclosed the data).
The guidance also says (p6/130):
"Can I use personal data for a new purpose, or disclose it to a third party?
If you intend to make a significant change to what you do with personal data, you will usually need to get your customers’ consent.
Individuals should generally be able to choose whether or not their personal data is disclosed to another organisation, unless one of the Act’s specific exemptions applies. If you did not make your intention to disclose information to a third party absolutely clear at the outset, at a time when the individual could choose not to proceed, then you will usually need to get the individual’s consent before making such disclosures".
When the SLC started reporting defaults to the CRA's in 2009, this was obviously a significant change to what they do with personal data - I'm assuming they didn't get the customers' consent before doing it - however one of the circumstances where exemption to the DPA provisions applies is "where disclosure is required by law or is necessary for legal proceedings", so that's their get out clause. However, Erudio wanting to disclose our deferred loan data is another significant change, so they need our consent, and the exemption above wouldn't apply to deferred loans.
Also, I don't think s.16 makes it crystal clear it was the SLC's intention to disclose info to a third party, only that they might (subject to the DPA provisions).
Haven't got time to get any further through the guidance just now, but pages 97-99/130 cover consent - there's also more ICO guidance on data sharing here, which might be helpful when looking at whether Erudio sharing the data is justified:
ico.org.uk/for_organisations/guidance_index/~/media/documents/library/Data_Protection/Detailed_specialist_guides/data_sharing_code_of_practice.ashx
@ erudioed Your point re Zach Lewy saying they have to give data to get data back - doesn't the fact that Erudio are already performing credit searches to verify information (without having shared any of our loan data) blow that argument out of the water?