UK banks breaching data protection rules, it is claimed

Some of the UK’s biggest banks could be breaching data protection rules with alarming regularity, according to consumer giant Which? Money.  But the organisation which represents banks denies this and says disputes over information held are not the same as protection misdemeanours.

According to a report published today (Wednesday May 25) there were 515 complaints lodged with the Information Commissioner’s Office (ICO) about possible data protection breaches by eight of Britain’s biggest banks and building societies between August 2009 and August 2010 where the ICO thought it was likely they had broken the rules.

And, with Which? Money research showing that just one in ten people (13%) have heard of the ICO, the consumer champion warns this could just be the tip of the iceberg.
 
Barclays was the bank with the most suspected breaches with 116 complaints, followed by Lloyds TSB with 114 and Santander with 103.
 
Over half of all complaints arose from firms failing to provide customers with copies of the data held about them properly. Other potential breaches included banks holding inaccurate data about customers, failing to follow security measures and the disclosure of data to third parties.
 
While data related complaints about other organisations such as local authorities and HM Revenue & Customs are going down, banks and other lenders appear to be getting worse at looking after our data. In 2009, there were 1,163 complaints about financial services firms, up from 1,060 the previous year.
‘Banks and building societies hold incredibly sensitive information and the impact on customers can be serious if they mishandle it, from affecting credit ratings to leaving people open to fraud,’ said Which? executive director, Richard Lloyd.
 
‘Consumers who suffer financial loss or stress as a result of data mismanagement by firms should be entitled to compensation. Regulators need to impose much tougher sanctions on firms who are lax with people’s data as the message clearly isn’t getting through,’ he added.

But the British Bankers’ Association said that many of the cases referred to by Which? are not security breaches at all. ‘They are cases where customers have disputed the information contained on their records or allege that banks have not provided all the personal data they are entitled to receive about themselves under the Data Protection Act, and the Commissioner has been asked to investigate,’ it said in a statement.

‘Growing numbers of cases stem from claims handling companies, which dispute their customers' records in order to try to strike out credit agreements. All of the UK's banks take data privacy extremely seriously. All complaints are fully and immediately investigated and remedial action taken where necessary to ensure no harm comes to any customer. All banks have robust security processes in place to manage the high volumes of data needed to operate the UK's 140 million personal current accounts,’ it added. ‪