Members who complained to Mr Charlie Nunn, Group Chief Executive, regarding the trawling of staff accounts have received a standard response from the Bank.
The Union has put together two responses for members and their partners/spouses to send back to Lloyds. Those two letters can be downloaded using the below links. The text of each letter is also included beneath each link in case you have any difficulty downloading them. Members can amend the letters to suit their requirements.
Please note that although the download links should work on mobile devices, it is likely to be easier to download the documents on a desktop computer or a laptop.
Members can also refer their complaint to the Financial Ombudsman Service using the online complaints form. We will deal with that in a separate email which will be sent to members in the next few days. In the meantime, members with any questions can contact the Union’s Bedford Office on 01234 262868 (Choose Option 1).
Member Letter complaint to Lloyds
Dear Sir,
Reference [member insert complaint reference number]
I refer to your letter dated [Member insert date of letter from Lloyds]
In respect of the trawling of data, you say: “These statistics were purely numerical, such as averages, and contained no personal information.”. You also say: “We created aggregated statistics about customers receiving monthly Lloyds Banking Group salaries.”. If that’s the case, can you provide me with a copy of the exact data you shared with the in-hose staff unions. That information should be provided in the same format provided to the unions. If you refuse to provide that “anonymous” information, then it can only be because it wasn’t anonymised or aggregated in the way you have suggested.
You say that it’s “possible your account was included in the creation of these statistics, and this could include joint accounts. However, please be assured that no account holders were directly personally identified.”. Why doesn’t the Bank know whether my account was included in the statistics? How did the Bank identify which members of staff to include in the statistics? How was my account accessed and when was that done?
The ICO Guidance on ‘legitimate interests’ explains that determining whether this justification applies can be broken down into three parts: whether the processing is for a legitimate interest; whether it’s necessary for that purpose; and whether the interests, rights and freedoms of the data subject override that legitimate interest.
Can you explain how the Bank came to the decision that the only way to determine my ‘financial resilience’ was to access my personal current account?
Did the Bank consider other alternatives. If so, what were those alternatives. If not, why not?
You refer to the Group’s data protection notice which says: “A legitimate interest is when we have a business case or commercial reason to use your information. Even then, it must not unfairly go against your rights”. I think what the Bank did, without my express permission, goes against my data protection rights in the most egregious way possible.
I look forward to your reply to all my questions and receiving the anonymised data I’ve requested.
Yours sincerely
[Insert Name]
Wife/Husband/Partner complaint to Lloyds
Dear Sir,
Reference [member insert complaint reference number]
I refer to your letter dated [Member insert date of letter from Lloyds]
In respect of the trawling of data, you say: “These statistics were purely numerical, such as averages, and contained no personal information.”. You also say: “We created aggregated statistics about customers receiving monthly Lloyds Banking Group salaries.”. I don’t receive a monthly salary from Lloyds and the fact that my [insert reference: husband, wife, partner etc.] is does not give you the right to access my account without my express permission. I am not an employee of Lloyds Banking Group.
You say that it’s “possible your account was included in the creation of these statistics, and this could include joint accounts. However, please be assured that no account holders were directly personally identified.”. Why does the Bank not know whether my account was included in the statistics? How did the Bank identify which customers to include in the statistics? How was my account accessed and when was that done?
The ICO Guidance on ‘legitimate interests’ explains that determining whether this justification applies can be broken down into three parts: whether the processing is for a legitimate interest; whether it’s necessary for that purpose; and whether the interests, rights and freedoms of the data subject override that legitimate interest.
Given that mine is a joint account did the Bank consider using other alternatives? If not, why not?
Why did the Bank consider it “legitimate” to access joint accounts when it could have excluded them from its data search?
You refer to the Group’s data protection notice which says: “A legitimate interest is when we have a business case or commercial reason to use your information. Even then, it must not unfairly go against your rights”. I think what the Bank did, without my express permission, goes against my data protection rights in the most egregious way possible. I am not an employee of Lloyds Banking Group.
I look forward to your reply and receiving the anonymised data I’ve requested.
Yours sincerely
[Insert Name]