Since serving the DPA Subject Access Rights Notice on the Halifax as mentioned in my posting "The HALIFAX - DPA Subject Access Rights" I have now received a Pre-printed form from them.(posted 8593 days ago)This form requires me to tick boxes on which type of information I require. i.e. Mortgage, Current Account etc. Whereas I am entitled under section 7(1) of the 1998 Data Protection Act. to any data held.
My major concern with this form is that I believe the Halifax are using it so that the data subject (myself) implicitly limits the information that the Halifax has to supply to within parameters that the Halifax themselves have defined for their own purposes. For instance there is no box to tick regarding the data that they may hold on me under complaints, debt tracing and collection, trading in personal information etc. The Halifax had already received from me the correct request for disclosure as specified within the act, so this form is NOT required!
I believe, by using this form, that the Halifax, may be deliberately deceiving the data subject into limiting the rights expressly granted to him/her by the Data Protection Act (1998). I will therefore be sending a formal complaint to the Data Protection Commissioner to that effect.
This form has obviously confirmed my concerns as to whether I would be able to see all the data that is held by the Halifax regarding myself.
So in the small "Other" portion of the form where they suggest Roll No. etc. I have in fact detailed the request for ALL data in each data class held within each DPR entry for the Halifax. I have listed the Registration number for each entry but not any data class titles as I am aware of the Copyright notice on the DPR web site. I have also asked for source/disclosure info regarding each data class and for them to state if a data class is "empty" or not.
It remains to be seen now how they react to this request because I believe it's plainly obvious from their form that they would prefer to only supply a limited amount of data regarding any data subject.
They could:
Pretend they've not received the form (Difficult as it was sent recorded delivery)
Ignore the specific data class requests within the form (Possible but I have a copy)
Say they do not have to supply the data held in classes (Possible but refer to the Act)
Actually send me all the data they hold on me (Possible but remains to be seen if they do)
They could .............. (Any Ideas?)
Anyway the 40 days starts from when they received my legal request and enclosed fee, NOT from when they receive their questionable form.
I will post the outcome/progress on the Subject Access Rights Request and my formal complaint to the Data Protection Commissioner as soon as I receive it.