Jason's Data Protection Blog

2006-09-21T06:01:00.000-07:00

Another infringement of the DPA by Lloyds TSB...

I've just realised that Lloyds has probably just infringed my rights under the DPA again. I made my second request to them at the beginning of August and now - more than 50 days later - they have admitted that they are continuing to search for the information I requested and are trying to provide it.

This is not within the 40-day limit imposed under the DPA and therefore, I suspect they have failed to act according to the Act again.

Not surprising, really.

2006-09-21T05:59:00.000-07:00

A trail starts to emerge…

Following my complaint to Lloyds that they hadn't provided me with the full information I requested, I received more information from Lloyds on the 19th.
It was simply a record of one of my initial phone calls to them about the problems I had with my SMS alerts. Not very interesting but it shows the initial steps the Customer Care team took when they heard from me. It also shows they "handed off to Internet" banking.

A letter from the Data Subject Access Request team said they would continue to investigate for more information and get back to me.

I find it interesting that the data trail ends when my complaint was handed over to the Internet Banking team. Firstly, because I'd generally expect that the internet team would be the ones most able to provide the data under the DPA but also because I'd expect the internet banking team to be most aware of the act.

However, it's also interesting because it makes me wonder if they haven't found any data about it because the Internet Banking team never did anything. Maybe they can't find any data because Lloyds could care less about what they had done when they disclosed my personal financial details.

2006-09-12T12:13:00.000-07:00

Now why didn't I think of this before...

I've just searched on the BBC Website for "Data Protetcion Act" only to discover and even greater wealth of content on the act than I expected. Golly, I sure think that website is the greatest one on the Web ;)

Here's some of the treasures I found:

Simple information on the act for students revising for IT GCSEs: http://www.bbc.co.uk/schools/gcsebitesize/ict/legal/0dataprotectionactrev1.shtml

Questions and Answers about the act:
http://www.bbc.co.uk/webwise/askbruce/articles/security/dataprotection_1.shtml

2006-09-08T02:14:00.000-07:00

Some related stuff...

I've done some searching around to see if anyone else is on a similar mission to me and to see who else is concerned about these types of issues. Here's what I found:

Matt is on a similar journey with Orange and has organised an online pledge group to get people to request their personal data.

Tim is trying to get his data from the NHS.

Non-Terminal Boredom and McBlog are both using the DPA to try to get data in cases against their banks regarding overdraft fees.

Rebecca Wong's blogging on the DPA and similar issues is also interesting reading.

2006-09-07T02:54:00.000-07:00

New ICO site...

The Information Commissioner's Office has published a new - much improved - website. Well done!

http://www.dataprotection.gov.uk/

2006-09-07T02:43:00.000-07:00

I thought I'd made progress...

A package of documents arrived from LLoyds TSB on September 1st. However, instead of shedding light on the situation, I'm afraid it points to more deception (or incompetence) on their part.

While the documents contained a tremendous amount of interesting detail about me (including that I have a good credit score - PHEW!), they hardly contained any reference to the incident with my financial details being disclosed via SMS.

There was one reference to my initial phone call - but no further information. Strange since I called numerous times and got numerous personal letters from Lloyds about it. There were records of other (less serious) complaints including details of my contacts with the bank, how it was handled and what correspondence was sent.

I suspect Lloyds are trying to cover their tracks on this by withholding the information on it.

Today I spoke to Lloyds Data Subject Access Request team again (to a chap called Graham Hooper who works with Janet Ayers, the woman I originally spoke to). I explained the situation to him, including the fact that I was getting very suspicious, and asked him to try to find the missing information.

I'm also going to be writing to the Information Commissioner's Office to update my file on the matter as they've let me know they're assigning it to a case team for investigation.

2006-07-28T03:43:00.000-07:00

More aggrevation.

I received a 4-page form in the post from Lloyds yesterday telling me that I needed to give them more information about why I wanted the information I'm requesting (and finally informing me of the fee). I was fairly certain that I didn't need to tell them what I wanted the information for and after speaking to a number of my colleagues, felt fairly certain this was the case.

It certainly seemed like the more information I gave them about why I wanted the information, the easier it would be for them to keep me from getting the information I wanted. (They could, of course, read this blog, but I'm waiting to see how long that takes.)

This morning I called the Information Commisioner's DPA advice line and spoke to a friendly adviser who was very helpful in explaining my rights under the Act. (This useful document from the ICO explains "When and How to Complain" and contains the helpline number. There's also an online enquiry form to request help or information.)

He advised that I potentially had 3 complaints against Lloyds. They are (potentially):

- The initial disclosure of my financial information;
- Failing to reply to my initial request within the 40 day time limit and;
- Trying to require me to tell them why I wanted the information.

I was very impressed with the man I spoke to a the ICO since he really seemed to feel that he was a citizen advocate and encouraged me to complain so that this type of thing wouldn't happen to other people. He impressed upon me the importance of doing this not just for my sake but for the sake of the public.

This weekend I'll be gathering the information I need for the complaint form. I will also be sending Lloyds a letter saying that I'd like to proceed without having to tell them why I want the information. (Sounds like a fun weekend, huh?)

2006-07-25T05:19:00.000-07:00

Heard back from Lloyds today. They can't track down anything about my DPA request but are still trying to figure it out. They're going to send me a form I have to fill out and something about the £10 fee.

They don't seem to acknowledge that they've messed up (yet again) on this and whenever I mention that they're late in processing it, they avoid the topic.

Maybe its time to contact the Information Commissioner since I'm not sure if this is just more runaround or if they'll ever get it right.

2006-07-24T09:01:00.000-07:00

I've had to call Lloyds again to follow up on what's happening.

I called the Data Subject Access Request Team to tell them that I hadn't heard from the Brixton Branch after 4 working days, as they said I would. No surprise there.

Janet, the woman I originally spoke to, had left for the day already and is supposed to call me back tomorrow. Fingers crossed, but I'm not holding my breath.

2006-07-21T07:27:00.000-07:00

Welcome.

I work for the future media department of a major media company in the UK and therefore, am the type of guy that many of you would expect to have had a blog since he was born. However, before being a geek, I was (and still am to an extent) an editor.

The very task of editing is making the decision of what should and shouldn't be published and since I never felt I had anything worthwhile to talk about on a blog, I've always resisted having one. However, I now have a story that feels like its worth telling and that may be changed through the my blogging about it, so here goes. (With this type of introduction, I should thank a few of my friends who encouraged me to blog about it.)

And so, here's the background to my story.

My ex and I shared bank accounts with Lloyds TSB for a number of years and when we split up last year, we clearly had to separate our finances. As we went our separate ways, we both remained Lloyds customers and had separate accounts.

A few months after the accounts had been separated, I decided that, being the geeky kinda guy I am, that I'd sign up for text alert services about my current account. Now, working in new media, errr, future media, I know that web/mobile applications sometimes go wrong and I seriously thought about it before I signed up to have my financial data flung around the internet and mobile networks.

But, after some thought, I decided to go ahead based on the following:

- Lloyds is regulated by the Financial Services Authority and Banking Code on the financial side, which both clearly state how customer's financial data should be treated.

The Banking Code clearly states:

"We will treat all of your personal information as private and confidential, and operate secure and reliable banking and payment systems" (This is a handy PDF pamphlet version of the Banking Code.)

On top of this, the software industry often points to banks as having the best software security and development practices in the world.

Plus, if anything went wrong on the banking side, I could always complain via the Financial Ombudsman Service. (I hoped this would never be necessary!)

- On the personal data/digital privacy side of things, Lloyds is also subject to the Data Protection Act which is administered by the Information Commisioner.

and

- I trusted Lloyds. Plain and simple - they'd been my bank for around 8 years and never messed me around before. Why would they now?

Needless to say, I made the wrong decision. After receiving the text alerts for a while, with no problem, I heard from my ex saying that they had started texting my transactions to him(including they payment of my salary). At the same time, they stopped sending the texts to me.

Lloyds had let me down, embarassed me and compromised my privacy and the security of my finances.

To add insult to injury, the first few customer service people I spoke to refused to take me seriously. One actually told me to calm down because it wasn't important and another told me that I was "wrong" and that it was "absolutely impossible" that it had happened.

After months of complaining, I finally got a meagre apology from Lloyds with little attempt to assure me that this wouldn't happen again, that my personal/fiancial data was now safe with them or any attempt to try to retain me as a customer or compensate me for the embarassment they caused me, risk they'd exposed me to and months of hassle I was subjected to through enduring their complaints procedure for months.

(The Banking Code also states: "We will act quickly and sympathetically with things that go wrong and consider all cases of financial difficulty sympathetically and positively." Ha!)

I decided at this point that the best thing to do was change banks. Lloyds clearly didn't care about me and I didn't feel safe continuing to do business with them. I also decided not to complain further, until my money was out of Lloyds.

It took months to change my finances over completely to another bank. When I finally closed my accounts at Lloyds, I delivered a letter by hand to the Brixton branch, requesting the accounts be closed and that under the Data Protection Act (DPA), I was requesting all of the personal data Lloyds has ever held about me (basically so I could see the full process of what had happened with my complaint). I specifically checked with the banker I dealt with that he understood what the DPA request was and that he knew what to do with it. He said he did and that the relevant branches would be contacted to collate the data. This was on 7 June 2006.

My accounts were quickly closed and I waited to hear back about my DPA request. Under the act, the firm you request your data from has 40 calendar days to respond. (This is a useful "how to" on the DPA from the Department of Constitutional Affairs.

I waited a little over 40 days until 19 July (Wednesday) and heard nothing. I called Lloyds and was put in touch with a woman named Janet in the bank's Data Subject Access Request Team who log and handle DPA requests. She said she had no record of my request but, helpfully, said she'd call the manager at the Brixton branch to see what had happened. She also admitted that I should have had a response as the 40 calendar days had passed.

She also asked if I'd payed the £10 fee for such requests - unsurprisingly, I'd never been made aware that this was a charge I'd need to pay. This just proved to be more annoyance and bad customer service from Lloyds.

Janet later called me back to say the Brixton Branch manager would be calling me to explain what was happening and now, 2 days later, I've still heard nothing and continue to wait.

So, here I am on the internet, hoping that by making the issues and problems I've faced public, that I will raise the profile of the problem and:

- Help other people from falling into the position I was put in;
- Find out more about what Lloyds does with personal/financial data and whether they treat it seriously or not;
- Chronicle the process of trying to find this information for myself and for record on the internet and;
- See if blogging affects how this unfolds.

Please contact me if you've been affected by similar issues so we can compare notes.