Feeds

Info Commissioner audits HBOS

Investigation into binned bank statements underway

Next gen security for virtualised datacentres

The Information Commissioner's Office (ICO) is conducting an audit of Halifax Bank of Scotland's (HBOS) data security procedures after it was revealed that the bank was putting customers' financial documents in ordinary bins.

The act, uncovered by the BBC's Watchdog programme, is in breach of an undertaking to the ICO signed by HBOS earlier this year after it was found throwing out documents containing customer details.

The ICO is conducting an audit of HBOS and its security procedures and will soon examine the evidence gathered by Watchdog. If a breach is found then it will serve an enforcement notice on the bank. A repeat offence in breach of the notice will be a criminal offence and will open HBOS to prosecution.

"This was one of the banks that signed the undertaking last year," said an ICO spokeswoman. "If they are found to be in breach of that then the next step will be enforcement action.

"An enforcement notice would outline what they needed to do, ordering them to make sure they have the procedures in place to make sure it doesn't happen again. If it does it is a breach of an enforcement notice," she said.

Watchdog reporters said they found torn up bank statements which revealed customer names and account numbers and a complete, untorn cheque for nearly £1,700 in a bin outside a branch of Halifax.

HBOS apologised in a statement. "We're very sorry for any inconvenience we've caused. All of the relevant authorities, including the Information Commissioner and Financial Services Authority (FSA), were informed immediately.

"We process over 100 million transactions through our branch network every year. This incident, which is clearly regrettable, needs to be viewed within that context. Following the approach from Watchdog, we're reviewing our procedures again," said the bank.

HBOS chief executive Andy Hornby signed the ICO undertaking after it was found by the ICO to be throwing documents which identified customers and their banking details into ordinary bins. The ICO said this was a breach of the Data Protection Act.

"[HBOS will ensure that] adequate and relevant data protection training [will] be given to all employees including emphasis on the importance on [sic] confidential secure waste disposal," read Hornby's undertaking. "Customer facing outlets will be equipped with secure lockable bins for confidential waste disposal." The undertaking said that all lockable bins and shredders should be deployed by 28 February this year.

The ICO can audit organisations to ensure their procedures are adequate to protect people's privacy, but must have the permission of the organisation first. Commissioner Richard Thomas last week called for increased powers, asking Parliament to give him the right to audit organisations even when not given permission.

See: The HBOS undertaking (3 page/1MB PDF)

Copyright © 2007, OUT-LAW.com

OUT-LAW.COM is part of international law firm Pinsent Masons.

The essential guide to IT transformation

More from The Register

next story
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
Chinese hackers spied on investigators of Flight MH370 - report
Classified data on flight's disappearance pinched
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
prev story

Whitepapers

Top 10 endpoint backup mistakes
Avoid the ten endpoint backup mistakes to ensure that your critical corporate data is protected and end user productivity is improved.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Backing up distributed data
Eliminating the redundant use of bandwidth and storage capacity and application consolidation in the modern data center.
The essential guide to IT transformation
ServiceNow discusses three IT transformations that can help CIOs automate IT services to transform IT and the enterprise
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.