Disclaimer

The new DPC website is currently under construction. Our latest guidance in relation to GDPR, which comes into effect on 25th May, 2018, can be found at gdprandyou.ie and via pages on this website starting with "NEW" as per the navigation pane on the left. All other material on this site relates to the previous legislative regime under the Data Protection Acts 1988-2003 ("the Acts"). While the Acts may continue to apply in some circumstances, as of 25th May, 2018 the GDPR is the primary piece of legislation governing data protection.

Data Protection Commission

CASE STUDY 8/97

Credit record indicated that borrower had faced litigation and loan had been partly written off – issue of accuracy – previous concerns about fair obtaining revived

A man who had difficulty in getting a mortgage made an access request under section 4 to a credit referencing agency. He found that there was a record relating to a hire-purchase agreement that he had entered into some years previously. This record showed that part of the loan had been written off. It also purported to show that before that had happened, litigation had been pending against him. (The credit referencing agency uses codes which show the history of a loan over a period of months.)

The man complained to me, and described what had happened with the hire-purchase agreement. The agreement was for four years, but the payment book he was given was for three years only. Believing that once the book was finished the loan was cleared, he stopped making repayments. Some months later the finance company looked for the remaining twelve monthly instalments, together with additional interest that had accrued since the complainant had stopped his payments. Following negotiations between the parties the data controller agreed to accept the twelve outstanding monthly payments and to write off the accrued interest.

The complainant alleged that his record with the credit referencing agency contravened section 2(1)(b) of the Act – which provides that "data shall be accurate and, where necessary, kept up to date" – in two respects: he denied that an element of the loan had been written off, or that litigation against him was ever pending.

My investigation of the complaint established that the hire purchase agreement had, in fact, been for four years, not three, and that the complainant had fallen into arrears in the fourth year. At that point, the account could have been transferred to the company's legal department for proceedings to be prepared against him. However this was never done. Accordingly, I found that the complainant's record was inaccurate in stating that litigation had been pending.

My investigation also established that a settlement had been agreed between the complainant and the finance company, in which the company waived the interest due on his late payments. In this respect, I found that the complainant's record was not inaccurate in stating that an element of the loan had been written off. However, this aspect of the complaint raised an issue about which I have expressed concern before - the consequences for a person who settles a loan for less than the full amount owed. Section 2(1)(a) of the Act provides that information constituting personal data "shall be obtained and processed fairly". The obligation to obtain data fairly requires a high degree of transparency on the part of a data controller. I have expressed my concern before about whether there is sufficient transparency when loans are settled by agreement with amounts written off.

I reiterated my concern to the finance company in this case. I noted that the company had previously and voluntarily deleted the details of the loan altogether from the credit referencing agency's records. In this Report, however, I think it correct to point out that the practical consequences for a data controller of non-compliance with the fair obtaining requirement are potentially serious. Section 6(1) of the Act provides that -

"An individual shall, if he so requests in writing a data controller who keeps personal data relating to him, be entitled to have rectified or, where appropriate, erased any such data in relation to which there has been a contravention by the data controller of section 2(1) of this Act; and the data controller shall comply with the request as soon as may be and in any event not more than 40 days after it has been given or sent to him"

The implication of this provision, in the context of cases like this, is that a data subject whose personal data have not been obtained fairly may assert his entitlement to have them deleted altogether.