United Kingdom Information Tribunal including the National Security Appeals Panel

Halifax Building Society v Data Protection Registrar [1992] UKIT DA92_B1 (25 January 1992)

IN THE DATA PROTECTION TRIBUNAL

BETWEEN:

HALIFAX BUILDING SOCIETY Appellant

and

THE DATA PROTECTION REGISTRAR Respondent

APPEAL DECISION

Members of the Tribunal: John W T Walters (Deputy Chairman)

Kate Foss and Tony Cowling

1. This is an appeal against an enforcement notice dated 9 February 1989 served on the Halifax Building Society by the Data Protection Registrar.

2. Consultation having taken place between the parties prior to the hearing, an agreement has been reached and is annexed to this decision.

3. By consent, the enforcement notice is withdrawn by the respondent and the appeal is withdrawn by the appellant.

4. It is emphasised that this agreement and settlement in no way binds the Registrar in the exercise of his discretion in any future proceedings against the Society or others and is without prejudice to any future decisions of this Tribunal.

25 January 1992

J W T Walters

Chairman
 


IN THE DATA PROTECTION TRIBUNAL

IN THE MATTER OF THE DATA PROTECTION ACT 1984

AND IN THE MATTER OF THE REGISTRAR'S

ENFORCEMENT NOTICE TO HALIFAX BUILDING

SOCIETY DATED THE 9TH DAY OF FEBRUARY 1989

In consideration of the withdrawal by the Registrar of the aforesaid Enforcement Notice against Halifax Building Society ("the Society") the Society undertakes and agrees as follows:-

1. That in response to subject access requests made pursuant to section 21 of the Data Protection Act 1984 the Society shall henceforth make the same level of response as was made to Mr Ian Wright in the totality of the Society's responses in December 1987, August 1988, December 1988 and February 1989 (including in such response the data items of the type which were the subject of the Registrar's second preliminary notice against the Society dated the 12th June 1989 ("the Second Preliminary Notice").

2. That the Society will also send to each data subject in response to a subject access request and at the same time as it makes the response referred to in paragraph 1 above a notice in the agreed form annexed hereto, marked Appendix 1.

3. That in any instance in which the data subject is genuinely disputing or querying any transaction or transactions the Society will (in addition to the response and notice referred to in paragraphs 1 and 2 above) disclose to the data subject the relevant details of such transaction or transactions sufficient to permit the data subject to identify the same and which will include at the least the date and time when the transaction was made at the ATM, the amounts involved, the nature of the transaction and the location of the ATM (including, where more than one ATM is situated at a relevant location, the identity of the ATM in question). ^[1] For the avoidance of doubt nothing in this agreement shall be construed as a restriction on or exclusion of the powers of the Registrar to take action against the Society in the event of any future breach of the Data Protection Act 1984.

4. That the Society concedes that the data subject of the Second Preliminary Notice is

(a) personal data within the meaning of the Data Protection Act 1984; and

(b) not generally data to which the exemption in section 28 of the Data Protection Act 1984 would normally apply.

5. That the Society concedes for the purposes of this Appeal that the six categories of data the subject of this Enforcement Notice ("the six disputed categories") are personal data within the meaning of the Data Protection Act 1984 and that the Registrar shall be entitled to refer to and rely upon this concession in any future proceedings against the Society.

6. That both the Society and the Registrar reserve their positions in relation to the effect and the interpretation of section 28 of the Data Protection Act 1984 in any future proceedings against the Society.

7. That the Society agrees to withdraw this Appeal.

Robert S Smith QC and David Hatton

Counsel for the Society

Henry Carr

Counsel for the Registrar

Monday, 6th January 1992

APPENDIX 1
HALIFAX BUILDING SOCIETY
NOTICE TO DATA SUBJECTS

The Society is pleased to supply you, upon your request, with personal data which the Society holds about you. Please do not hesitate to contact the Society if you require any further assistance in relation to this.

In addition to the information enclosed, the Society would wish you to know that it has not included certain details concerning transactions on your account, such as the card number, the identification of the computer terminal at which a transaction is processed and the identity of the automated teller machine at the transaction location.

The Society, like all reputable financial organisations, is concerned to ensure the safety of its customers' funds. Our experience has shown that in order to protect the security and privacy of your account and those of other customers these details concerning transactions on accounts need to be kept confidential to only a small number of the Society's staff. Under Section 28 of the Data Protection Act 1984, the Society considers it is not obliged to disclose information which is likely to prejudice the prevention or detection of fraud or crime. This is one of the Society's reasons why these details have been omitted.

We stress that these details do not include details of your home, address, financial circumstances, the balance of your account or any views the Society or anybody have expressed about you. All of this has been made available to you. If it should transpire that there is a genuine need on your part to know all or part of the details concerning transactions on your account, the Society will always be pleased to consider your request for information and will do all it can to assist you.

Furthermore, if you are not satisfied with the response of the Society to your request, you are entitled to complain to the Data Protection Registrar at Springfield House, Water Lane, Wilmslow, Cheshire SK9 5AX.

Note 1   The Society will disclose this information other than as part of their response under the Data Protection Act 1984 and will do so only from information which they may hold on the Journal Roll from the ATM in question.    [Back]