Mr
5

Essex
RM

Our Ref. 00/01620/08/JHA

By Fax & Post

1st November 2000

Dear Mr ,

We are now in a position to make a final assessment in the matter of your complaint against Abbey National.

In March 1999 you applied to Abbey National for both a mortgage and a current account; the mortgage was accepted while the current account was declined. Staff at the Cannon Street branch suggested that the application for the current account should be resubmitted on completion of the mortgage. The members of staff at Cannon Street duly undertook this in August 1999, Abbey National acknowledge that this is not standard practice. In the response made to the Commissioner Abbey National have stated that the original application form was resubmitted as part of this process, however when the details were entered onto the computer they were inputted incorrectly.

• (Home Repossession Page note: Here you have the key to this dispute and to the damage Abbey did to this man. Abbey National's staff re-entered the customer's details into a bank account application themselves. But they messed up the entry for how long he had lived at his new address. Their automated anti-fraud system picked up the discrepancy between this incorrect information and the customer's original mortgage application and triggered a warning. Remember as you read on that it was Abbey's own staff that had created the discrepancy by inputting incorrect information.)

On the 5th August 1999 Abbey National undertook a search of your credit reference file. The details inputted by Abbey National incorrectly stated that you had resided at your current address for 3 years; subsequent searches on the 6th August gave information that you had resided there for 1 year. In fact you had only lived at 5 for a matter of weeks, a fact that was known to Abbey National as your mortgage providers.

• (Home Repossession Page note: What the DPC is gently saying here is that Abbey National's staff could have confirmed exactly how long the customer had lived at his new address if they had checked the details of the mortgage they had given him just a few weeks earlier to buy the place.)

The employee who conducted these searches has now left Abbey National's employment and they have found it difficult to ascertain why three searches were necessary and why contradictory information was provided.

• (Home Repossession Page note: But Abbey National's directors had not left its employment and they did know about this case months before the DPC produced this report. The customer sent its directors many faxes with details of what had happened. ukstatus.net was confidentially copied in on them through 2000. Yet Abbey National and its related company Pinnacle Insurance continued to make credit checks against this customer, totting up over 30 by the end of 2000.)

As the details provided by them differed from the previous application the Hunter fraud prevention system indicated a possible anomaly.

• (Home Repossession Page note: Hunter is a privately-owned national database of the personal details we all give for different mortgage, current account and loan applications at different banks. Lenders regard any discrepancies as suspect and usually investigate them. If they can't find a reasonable explanation they are likely to register you as a potential fraudster with CIFAS, who pass the warning on to the credit reference agencies. And so it snowballs...)

• Customer comment: Abbey and its related company Pinnacle Insurance continue to make credit reference file checks against me and had made over 50 by January 2001.

The matter was therefore referred for investigation of possible fraud. A fraud investigator tried to telephone you at your place of work to confirm the correct address details. There she spoke to a man she has not identified who stated that he did not know you. It is not clear who was spoken to and therefore whether he was in a position to verify your status as an employee.

• (Home Repossession Page note: In our opinion, not bothering to establish the identity of the man she spoke to while trying to verify the customer's employment claim was a breach of CIFAS' own procedures, not to mention a breach of the Data Protection Act 1984.)

You were then asked to provide proof of income, which after some delay you did, having already supplied this information in connection with your mortgage account.

It is your opinion that a member of Abbey National's staff completed and signed a second application form. In support of this you have submitted a statement sworn before a solicitor which details a telephone conversation that took place with an investigator. You assert that during this the investigator referred to a second application form and acknowledged that the signature did not match your own. Abbey National has stated that no records of any description were made of this telephone conversation and cannot therefore corroborate or deny the contents of the discussion. It is noted however that Ms Holland wrote to CIFAS on 9th June 2000 that "This second application matched on our Hunter system" and later in the same letter "...was not registered on CIFAS until October as the original paperwork went missing". There appears to be a discrepancy between Ms Holland's report to CIFAS and Abbey National's subsequent version of events. Abbey National has stated that Ms Holland was not in possession of a second application form. Rather, she was relying on the details inputted incorrectly by Abbey National staff. The letter from Abbey National to CIFAS could appear to indicated the presence of a second application form and it is unclear what original paperwork went missing or when, or whether it was subsequently recovered. Abbey National has not accounted for these points and there would appear to to be the possibility that CIFAS interpreted the comments in a similar manner to you.

Whilst some of the facts of the case are therefore difficult to substantiate, we have however collated enough information to form a decision about the processing of the data involved. It appears that there have been breaches of several principles of the Data Protection Act 1988 by Abbey National. You completed an application form the contents of which were accurate. It has been admitted than an employee of Abbey National then entered these details incorrectly causing Abbey National to process inaccurate data about you. This was in breach of the 4th Data Protection Principle. Even if no second application form exists this action alone had serious implications for you resulting as it did in investigation of possible fraud. When the case was brought to the attention of the fraud investigator it appears that inadequate checks were employed for the verification of the data. The original application, which would have absolved you immediately, was not referred to. Inadequate and undocumented checks were then made at your place of work and a CIFAS marker constituting sensitive data was filed.

• (Home Repossession Page note: In other words, after all this inadequacy, Abbey National told CIFAS that it thought this man might be a fraudster.)

In addition it is admitted that no records were made of conversations between yourself and the investigator. What would appear to be a basic check against other data held on Abbey National's own systems appear not to have been carried out.

Further investigation would have revealed that you already had a mortgage with Abbey National and confirmed both the correct address details and the fact your employment details had been previously verified.

• (Home Repossession Page note: So the Abbey National had the real truth sitting it its own files all along...)

The registration of the CIFAS marker in turn caused CIFAS to process inaccurate and inadequate data about you. The procedures involved in resubmitting your application and the subsequent fraud investigation appear to have been both inadequate and unreliable and therefore insufficient to support the allegation of fraud. None of the processing involved would have supported the burden of proof required to substantiate the nature of the accusations. Nor was the documentation of the process able to justify the actions of Abbey National's staff.

It is therefore our final assessment that the processing concerned was not carried out in compliance with the provisions of the Act, in particular that the data was not processed fairly, in breach of the First Data Protection Principle. Nor were the data accurate or adequate for the purposes for which they were being processed, in breach of the Third and Fourth Data Protection Principles. The procedures revealed by the case have given the Commissioner very serious cause for concern and we have asked that Abbey National undertake a full review of their procedures. Having undertaken the review we have asked that they confirm what steps have been taken to ensure that such an event does not recur.

Thank you for bringing the matter to our attention.

Yours sincerely

(Signature)

Ms
Compliance Officer