Banking Law

Bank's Confidential Info "eBayed"

It's one thing for Gov. Palin to try to sell the Alaskan state government's jet on E-Bay. It's quite another thing for your run-of-the-mill bank vendor to sell your personal information (including your banking information) through the same service.

An investigation is under way into how a computer containing bank customers' personal data was sold on eBay.

The computer, bought by IT manager Andrew Chapman for £77, had the sensitive details on its hard drive.

Mr Chapman, from Oxford, said the machine contained information on several million bank customers.

Details of customers of three companies, including the Royal Bank of Scotland (RBS) and its subsidiary, Natwest, were involved.

RBS said an archiving firm told it the computer had been "inappropriately sold on via a third party".

It said historical information relating to credit card applications for its bank and others had been on the machine.

The information is said to include account details and in some cases customers' signatures, mobile phone numbers and mothers' maiden names.

[...]

Mr Chapman said anyone with a basic knowledge of computer software would have been able to find the data fairly simply.

"The information was in back-up CDs and in ISO files so it would have been possibly quite easy to find if you know something about computers," he said.

Why a "backup" business allowed sensitive information of one of the bank's that it services to exist on a laptop, encrypted or unencrypted, is a question I'm certain that RBS and Natwest have been asking the vendor.

I hope for the sake of RBS and Natwest (and American Express, the third company involved) that their agreements with the archiving firm contained strong contractual obligations to protect such confidential information, and provided adequate remedies to those firms in the event those obligations were breached. Knowing Amex's standard practices, I assume that they do. Of course, they won't save the banks and Amex from the public relations hit to their reputation caused by articles such as the one linked above. However, they should give them financial recourse against the vendor.

The vendor should be sweating bullets.

A spokeswoman for data processing company Mail Source, which is part of the archiving firm Graphic Data, said it was investigating how the computer equipment had been removed from a secure location.

"The IT equipment that appeared on eBay was neither planned nor instructed by the company to be disposed," she said.

The incident was "extremely regrettable" and the firm was "taking every possible step" to retrieve the data and ensure it was an isolated incident, she added.

"Extremely regrettable." That was said with typical British understatement. I think that Graphic Data will, indeed, "extremely regret" this information security breach. Even more than Americans, Europeans take their privacy seriously. At least, they seem to where private businesses are concerned. On the other hand, they appear to love Big Brother a lot more than the libertarians who populate the U.S.A.

Luckily for the banks and Amex, the purchaser of the laptop turned out to be not only a knowledgeable IT professional, but also an honest man. While legal fines may be imposed by the appropriate government authority, at this point it appears that any such fines would be imposed on the vendor, not on the banks and Amex. Also, it does not appear that there has been any wrongful use of the personal information.

Once again, the lesson is hammered home: Don't allow sensitive data to be downloaded to a laptop unless it's encrypted. Yes, I know, encryption can make the performance of the laptop less speedy and the employees will bitch and moan. Believe me, they'll get over it.

Full post as published by Bank Lawyers Blog on September 14, 2008 (boomark / email).