The Financial Services Authority has fined HSBC £3m for failing to properly look after its customers' information and private data.
These failures to follow proper processes led to at least two losses of customer data.
The FSA investigated the bank and found unencrypted customer details on open shelves and unlocked cabinets. Customer details were also sent via the post or couriers to third parties, and staff were not trained in dealing with risks associated with identity theft.
In April 2007 HSBC Actuaries lost details on 1,917 pension scheme members. In July HSBC Actuaries, along with two other subsidiaries, were warned by HSBC Group Insurance's compliance department to sort out data security. But in February 2008 HSBC Life sent an unencrypted CD through the post containing details of 180,000 customers. The CD was lost.
HSBC Life UK Limited (HSBC Life) was fined £1,610,000, HSBC Actuaries and Consultants Limited (HSBC Actuaries) was fined £875,000 and HSBC Insurance Brokers Limited (HSBC Insurance Brokers) was fined £700,000.
Margaret Cole, director of enforcement at the FSA, said: "These breaches are very disappointing. All three firms failed their customers by being careless with personal details which could have ended up in the hands of criminals.
"It is also worrying that increasing awareness around the importance of keeping personal information safe and the dangers of fraud did not prompt the firms to do more to protect their customers' details."
Since HSBC cooperated with the FSA investigation, it had its fine discounted by a third. ®