2 May 2016, 09:00

A couple had their joint credit cards cancelled by a bank in what turned out to be a case of mistaken identity. Before the bank fixed its mistake, the couple sought access to information held about them to challenge the bank’s decision.

The husband and wife were informed by the bank in October 2014 that their joint credit card account had been frozen because of a bankruptcy notice on the wife’s file.

The couple then employed a law firm to seek access to the information held about them by the bank. They did this to challenge the decision to block their credit cards. An agency must respond to a request to access or correct personal information within 20 working days.

A solicitor at the law firm wrote to the bank in November 2014 requesting the information and informing the bank that she was acting for the couple.

After getting no response from the bank, the solicitor made a complaint to our office in December 2014 on behalf of the couple.

Principal 6 – Access to personal information

The  complaint raised issues under principle 6 of the Privacy Act. Principle 6 says individuals have a right to have access to personal information about them held by an agency. The right in Principal 6 is not absolute and sections 27-29 of the Act give an agency a number of reasons for withholding that information.

We contacted the bank in January 2015 to say that we were investigating and asked the bank to confirm whether or not it held personal information about the couple that was relevant to the decision to cancel the credit cards.

Our investigation also needed to establish why the bank had not responded to their request within 20 working days and whether there were justifiable reasons for withholding the information.

Bank’s response

A representative of the bank replied to us in February 2015 and apologised for a delay. The bank’s privacy officer had been on leave and then fallen sick. She explained that another person had been mistakenly linked to the wife’s bank account.

After the couple were informed that their joint account had been frozen, the bank realised it was an error and wrote to them explaining the mistake and apologising for it. Shortly afterwards the bank noted that a link to the couple’s joint account still contained the error showing an outstanding debt. A request was sent to the bank’s collection area for it to be fixed and the debt cancelled.  However the matter was overlooked because the staff member who was delegated to fixing the mistake left the bank.

Follow up requests

By April 2015, the couple still had not received the information they requested. When we followed up, we were told by the bank the information was almost ready to be released but care was needed to ensure no information about the other customer was disclosed.

In May and June 2015, we followed up repeatedly, contacting the manager of the bank’s complaints section. The manager eventually responded, admitting the couple’s case had “fallen through the cracks”.

Settlement

The bank apologised in a letter to the couple’s solicitor for the failure to response to the information request. It confirmed the bankruptcy was for a different person, and no legal action was ever taken against the couple, nor did the bank intend to pursue them for any debt. The bank had since taken action to correct all the information in its records so there was no link to the bankrupt person.

The bank offered a sum of money in compensation for distress and inconvenience. It also gave an assurance that the couple’s credit standing with the bank had not been adversely impacted.

The couple rejected this initial offer. After further negotiation, the bank agreed to write a formal letter of apology, and pay the couple’s legal fees as well as to substantially increase the offer of compensation. This revised offer was accepted by the couple and we closed the case.

May 2016

Mistaken identity ─ access to personal information─ bank─ agency to respond within 20 working days­ ─ Privacy Act 1993; principle 6