CASE STUDY 2/97

Data about two people combined in one record kept by a credit referencing agency – issue of accuracy

The complainant looked for a loan to buy a car, but he was refused. He then made an access request under section 4 of the Data Protection Act to a credit referencing agency.

The record he received in response showed that he had been lent money by a financial institution some years before, and that that loan had not been repaid according to the agreed terms. However the complainant had never had a loan with the institution in question, or any contact with it whatsoever. His record also showed that three other financial institutions had made enquiries about him to the credit referencing agency in the previous few months.

The complainant made his own enquiries to the institution from which he was supposed to have borrowed money previously. This institution confirmed that he had not borrowed money from it. The complainant was informed that the loan had in fact been taken out by a second party with the same name, and an address in the same general area as his own, but with a different date of birth. The complainant then informed the credit referencing agency that the loan related to a different person, and the lending institution confirmed this to the agency. Subsequently the agency wrote to the complainant saying that it had revised his record to delete the reference to the loan, and offering to send copies of its letter to all financial institutions which had accessed his record.

The complainant was aggrieved at what had happened. He asked me to investigate "wrong or misleading information" (i.e. the details of a loan which he had never had) which had been kept by the credit referencing agency and disclosed to those financial institutions which had made enquiries about him.

I sought the views of the credit referencing agency, which explained how the problem had arisen. When the second party had looked for a loan some years previously, the institution that he had approached had made two enquiries about him to the agency. The agency had no record of the second party, but it did have a record of the complainant. I was informed that two men had the same names and they both lived in the same general area, though their house numbers and street names were different. The credit referencing agency, following its practice when there is some similarity in names and addresses, sent the enquiring financial institution a copy of the complainant's record "to allow them to determine from their greater access to information on their applicant as to whether there was any connection between the individuals of similar name".

The complainant had been assigned a customer record number by the credit referencing agency, and this number was included in the copy of his record sent to the financial institution. The institution, when it subsequently approved a loan for the second party, erroneously associated the complainant's customer record number with it and submitted the details electronically to the agency. As a result those details were automatically appended to the complainant's existing record with the agency. (The credit referencing agency told me that some time later it had changed its computer systems so that details of new borrowings which contained customer record numbers were no longer automatically associated with existing records. Henceforth this would only be done by human intervention.)

I accepted that it was the financial institution and not the credit referencing agency which had made an error in assigning the complainant's credit referencing number to the second party's loan. However the agency was not justified in disclosing the complainant's record to the institution in the first place. His address was sufficiently different from that of the second party to clearly suggest that two different persons were involved. I was satisfied that the problems which ensued followed directly from this disclosure.

I upheld this complaint by reference to section 2(1)(b) of the Act which provides that information constituting personal data relating to a living individual "shall be accurate and, where necessary, kept up to date". I noted, however, that the inaccuracy was rectified when the complainant brought it to the attention of the credit referencing agency, and that the agency offered to clarify the situation to those institutions which had recently accessed the complainant's record.