(This is a copy of the post I put on Money Saving Expert).
Data Protection and passing data to Credit Reference Agencies.
-----
The issue seems to be whether clause 16 gives the right to pass data to CRA’s. The pre 1998 agreement was before the Data Protection Act 1998 came into force. The DPA came into effect in 2000. Certain data continued to be exempt from full compliance until 24 October 2007. The exemption given to eligible data covered the first data protection principle.
However, the exemptions in the the transitional provisions have now ended and all data being processed must comply with the principles contained in the 1998 Act.
The first data protection principle says:
“Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless—
(a) at least one of the conditions in Schedule 2 is met, and
(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.”
The conditions in Schedule 2 are
1.The data subject has given his consent to the processing.
- The processing is necessary—
(a)for the performance of a contract to which the data subject is a party, or
(b)for the taking of steps at the request of the data subject with a view to entering into a contract.
- The processing is necessary for compliance with any legal obligation to which the data controller is subject, other than an obligation imposed by contract.
4.The processing is necessary in order to protect the vital interests of the data subject.
5.The processing is necessary—
(a)for the administration of justice,
6(1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
(2) The Secretary of State may by order specify particular circumstances in which this condition is, or is not, to be taken to be satisfied.
So are any of the conditions in Schedule 2 met? In my opinion they are not.
The one which is banded about is that Clause 16 gave consent. However, what does consent mean? The place to start is the Directive which the 1998 Act implemented. The Directive is, “DIRECTIVE 95/46/EC OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL 24 October 1995", on the protection of individuals with regard to the processing of personal data and on the free movement of such data. If you look at the definitions in Article 2, it states, “(h) “the data subject's consent” shall mean any freely given specific and informed indication of his wishes by which the data subject signifies his agreement to personal data relating to him being processed.”
I have underline the words “specific” and “informed” as I think this is the key.
The wording of Clause 16 says:
“The Loans Act prohibits us from disclosing information about you to anyone else for use for soliciting custom for goods or services. The Data Protection Act 1984 also contains protections in relation to the disclosure of automatically processed information about you. Subject to these prohibitions and protections, and and any other relevant statutory provisions, we may however, if we judge appropriate, disclose to any person any information concerning or relating to this agreement.”
I submit that the last sentence emphasized in bold is hardly “specific” and as it does not indicate to whom the data may be given, it is hardly “informed” consent. The fact that the Post 1998 agreement at clause 12 states when confidential information may be passed, in my view acknowledges the requirements of the 1998 Act to be more specific.
So, I have argued that it would not satisfy condition 1. What about the other conditions? I don’t think they can argue that it is necessary for data to be passed to CRA’s to perform the contract (ie consider a deferment) because a credit file will not provided income information. The third condition is not fulfilled, ie there is no legal obligation to pass data to CRA’s. As to Condition 4, I fail to see what “vital interests” require the passing of information to CRA’s. Condition 6(1) would not apply because it would prejudice the rights and freedoms or legitimate interests of the data subject (the borrower).
So in summary, in my opinion I would argue that the passing of data to CRA’s would not be a fair and lawful processing of data because non of the conditions in Schedule 2 are met.
I am not an expert in the field of data protection law, but this is the conclusion I have come to from looking at the legislation.
Anthony Reeves