12

I will shamefully admit that it was only in the year 2021 that I finally built my own bookkeeping system. Yes, I should have done it 10-20 years ago, but I didn't. So now I'm in this situation:

First of all, I logged in to my bank (Nordea in Sweden) and discovered that it now only supported dumping data from not very long ago at all. I think it was just a couple of years, or even months. So I contacted them.

They responded that they "will not" give me any data that is older than 10 years, but that I can exploit a secret bug (yes, they actually said this...) on their website to basically ignore multiple error messages and force their website to keep feeding me data, until it hit 10 years back. That's when it stopped feeding any data, so I dumped the CSV and exported it into my own local database.

So now I have all my bank transactions between the first day of 2009 up until today. (Yes, that "10 year" limit was slightly off, so you clearly cannot trust a single word they or their website claims...)

I also tried to analyze the JSON data blobs and modify the requests to fetch older data, but it just displayed error messages then.

But obviously, the bank does have all my old transactions in their real database. I don't believe for a second that they have actually thrown it away, or that they ever will.

So why won't they give it to me? They didn't state a reason, and I kept asking repeatedly in different ways, but they consistently just told me that data older than 10 years isn't available or some cryptic sentencing like that. They didn't explicitly mention it, but many other companies keep using this stupid "GDPR" nonsense as an excuse to not give me their data, and perhaps this is somehow related to this.

But still. This is my own data. Not the data of somebody else. It's my personal bank account, and I'm logged in securely to prove my identity. I'm not asking for this via e-mail!

Clearly, they are unwilling to hand it out, but is there some way for me to force them to do so against their will? That is, without "going to court".

It really annoys me that I don't have a full transaction history to analyze. Can they be forced/persuaded?

PS: I've even offered to pay them money for it, but even if you pay them, the time limit is still "10 years".

ti7
  • 105
  • 3
H Salvas
  • 147
  • 1
  • 3

4 Answers4

43

Businesses only keep transaction data for as long as they have to

For a live loan account they will keep transactions while the account is live and then for as long as local law dictates (it varies but 7 years is typical). For transaction accounts it will generally be only for as long as required by law - typically what is required by tax law (again 7 years is typical) or as long as you can sue them under statues of limitations (2-5 years). Banks (and other businesses) do not keep records indefinitely.

10 years seems more than necessary.

Dale M
  • 237,717
  • 18
  • 273
  • 546
18

According to GDPR, they are required to delete data when there is no longer a legal reason to keep it. It would be madness to do this manually. There will be automatic processes going through the databases and deleting data when the documentation requirements have expired. Certain information will have to be kept for a very long time, like inactive accounts with a positive balance. Other information has no such requirements.

o.m.
  • 22,932
  • 3
  • 45
  • 80
6

But obviously, the bank does have all my old transactions in their real database. I don't believe for a second that they have actually thrown it away, or that they ever will.

"Belief" gets you in trouble! I win in court becuase I am able to view my chances of success dispassionately. I know more than my adversary about my chances of winning - If I won't win, I don't let it become a lawsuit.

You have a losing case here. Your belief that they have all your data forever is not realistic. I bet if you pull your paper statements, which you saved of course, you will see that there was a subtle or not-subtle change in the statement format. That's because they changed systems: Occam's Razor.

And a big part of the system change was the ability to generate the data you are enjoying now.

Typically banks keep data that old in archival storage. Often, offsite storage e.g. at an Iron Mountain facility (commonly an old mine). Getting it out of there would be a huge production in any form, and probably not the format you want.

Expect paper, because that is what satisfies courts. Judges can read paper, they can't read a CSV.

JBentley raises an interesting point about GPDR which likely means the old data has been destroyed utterly. GPDR does indeed require the bank share with you any information they have. This creates a perverse incentive for the bank. They don't need to provide under GPDR any data they don't have.... so it is in their best interest to destroy any data they don't need. So they write a businesswise-reasonable "data retention policy". Companies will keep data forever if it's cheap to do so; that would apply to data in their current system. But for data that lived on a pre-2009 legacy system they're spending millions to maintain, No way. That was taken out of service as soon as it was no longer needed to meet retention windows e.g. if the retention window is 10 years, they had a bonfire in 2019.

Harper - Reinstate Monica
  • 20,495
  • 2
  • 30
  • 88
-3

Make them an offer they can't refuse

They may indeed have the data, but it will unlikely be handy. It will be buried in some archives like Amazon Glacier, and exhuming it for you would be a one-off bespoke job their IT stars would have to perform. Normally they would only bother when there is a court order. They're a bank, not a Lost and Found.

Yes it's your data, but that doesn't mean they are obliged to serve it to you any time/place you realize you've lost it again.

So, you just have to ask them nicely and offer enough $$$ motivatation.

Greendrake
  • 28,487
  • 5
  • 71
  • 135