Powerchex warns financial institutions on poor data security
London, June 19th, 2009. Powerchex Limited, the leading pre-employment screening firm for financial institutions, has backed the Financial Services Authority (FSA) in their stance on the data security measures finance firms should be employing to protect customer data.
In a paper released in April 2008, the FSA highlighted a number of examples of bad practice by financial services firms. Amongst their findings they discovered that generally a high level of vetting is being applied to senior staff, but junior staff and those working in areas that would allow them to view sensitive data are not being vetted appropriately. Most notably very few firms were found to be conducting criminal record checks on junior staff.
“We strongly advise our clients to determine the level of vetting required using a risk based approach rather than a rank based approach. Someone who works in a call centre is likely to have access to large volumes of customer data. So are they less of a risk than a senior manager? Not in our view, so why should they be vetted to a lower level?” says Alexandra Kelly, Director of Powerchex.
The FSA also found that some financial firms were subjecting temporary workers to less rigours vetting than permanently employed colleagues carrying out similar roles. Kelly believes that firms are starting to realise the biggest threat is from within.
“Temporary workers pose the same, if not a bigger risk to the company than permanent employees. Data Security is not just an IT issue. Firms should appoint a senior manager who heads a committee that has representation from all areas of the business, including Human Resources. And firms should also be asking their suppliers the same questions they ask themselves in regards to how sensitive data is kept safe.”
The FSA backed up their report by handing out a hefty fine to Merchant Securities Group Limited (Merchant Securities) in June 2008 for weak data security. Margaret Cole, Director of Enforcement at the FSA, said, “Reducing financial crime in the UK is a priority for the FSA and our recent data security report showed that many firms still need to do more to get it right. We will not wait until information has been lost or stolen before taking action against a firm. The level of the fine for a firm of this size should serve as a warning to others to take data security seriously.”
As the need for financial institutions to hold and transfer sensitive data increases, so does the risk they face. In the future financial firms are likely to employ more and more stringent data protection measures and their employees and suppliers can expect to be checked more thoroughly and more often.
Showing posts with label protecting customer data. Show all posts
Showing posts with label protecting customer data. Show all posts
Friday, 19 June 2009
Friday, 6 March 2009
The Information Commissioner is showing his teeth... finally!
Big news today about a company which was holding, processing and selling personal data which was obtained with questionable means and without applicant consent. Powerchex issued the following press release:
____________________________________________
“Show respect for personal data” warns pre-employment screening company Powerchex
The Information Commissioner’s Office is showing its teeth in a case that may spur far reaching regulation of companies that maintain and sell personal data.
As part of an investigation of the Guardian, The Information Commissioner’s Office closed down an investigating firm that was maintaining and selling data from an illegal database. Buyers of the information, which include some of the biggest construction firms in the UK, will also be prosecuted.
Yesterday David Smith, the deputy information commissioner, said: "This is a serious breach of the Data Protection Act. "Not only was personal information held on individuals without their knowledge or consent, but the very existence of the database was repeatedly denied [by the industry]. "The covert system enabled Mr Kerr to unlawfully trade personal information for many years, helping the construction industry to vet prospective employees. Kerr held information on thousands of construction workers and profited by checking names against his database."
“Companies have often shown a cavalier attitude on how they store, transmit and protect personal data” states Alexandra Kelly, Managing Director of pre-employment screening company Powerchex.
“Light sentences from the Information Commissioner, as well as a perceived impression that companies that break the code will not be prosecuted have resulted in a lax treatment of personal data including employee, customer and other such sensitive data.”
The Financial Services Authority, which regulates the UK financial services sector, recently issued a consultation paper to help firms ensure that they treat customer and employee data in a secure fashion.
Examples of good practice in terms of treating personal datas laid out in the report include:
· All customer/employee data to be disposed of securely using shredders or confidential waste bins
· Treating all data as confidential waste to eliminate confusion about which type of bin to use.
· Providing guidance for travelling or home-based staff on the secure disposal of customer data
· Conducting due diligence of data security standards at third-party suppliers before contracts are agreed
· Regular reviews of third party suppliers’ data security systems and controls
· Ensuring tht third-party suppliers’ vetting standards are adequate
· The use of secure internet links to transfer data to third parties
“Companies that handle personal data should make sure that third parties who process this data are also compliant with the Data Protection Act” says Kelly, “and of course, everyone must be registered with the Information Commissioner” she concludes.
________________________________________________________
The Guardian that broke the story after investigating reported:
More than 40 major British companies face legal action for allegedly buying secret personal data about thousands of workers they wanted to vet before employing them.
The information commissioner, Richard Thomas, will today publish a list of the companies he believes may have broken data protection laws, after an investigation by his office that was sparked by fears that many workers were being unfairly "blacklisted".
The commissioner alleges that the firms, including Balfour Beatty, Sir Robert McAlpine, Laing O'Rourke and Costain, have, for many years, covertly bought details of workers' trade union activities and their conduct at work.
Thomas believes that workers have been unfairly denied employment because they have had no chance of challenging any inaccurate information, some of which has been stored for decades.
Asked by the Guardian to respond to the claims, many companies refused to comment. Others denied using the data to "blacklist" troublesome workers covertly, or said they had stopped buying the data.
The commissioner has already taken action rapidly to close down a private investigator who is accused of clandestinely compiling an "extensive intelligence database" of 3,000 workers with details that stretch back to the 1980s.
The commissioner is to prosecute the private detective, Ian Kerr, who is accused of selling the information to companies in the construction industry when they wanted to vet potential staff. Thomas said he had seized documents which, he says, show that files on individuals included comments such as "communist party", "ex-shop steward, definite problems, no go", "do not touch", "orchestrated strike action" and "lazy and a trouble-stirrer".
David Smith, the deputy information commissioner, said: "This is a serious breach of the Data Protection Act. Not only was personal information held on individuals without their knowledge or consent, but the very existence of the database was repeatedly denied.
The covert system enabled Kerr to unlawfully trade personal information on workers for many years, helping the construction industry to vet prospective employees.
"Kerr held information on thousands of construction workers and profited by checking names against his database.
"Trading people's personal details in this way is unlawful and we are determined to stamp out this type of activity."
Construction workers have long complained that they have been stopped from getting work because companies were covertly turning away people they believed to be active trade unionists. Hard evidence has, until now, been hard to come by, and the construction industry has always denied it.
Steve Acheson, who believes he has been blacklisted, said he was "absolutely thrilled" by the findings of the commissioner's investigation.
The electrician, 55, from Denton in Manchester, said: "I've been angry for so long. It affects your character and demeanour - it's the fact it's so blatantly unjust. I was disgusted that one man could make a living from denying other men the right to work".
The Labour government has been criticised for passing a law banning the practice of so-called blacklists in 1999, but then, in a U-turn, deciding not to take the final step of implementing the law on the grounds that "there was no hard evidence that blacklisting was occurring". Technically, therefore, "blacklisting" is still legal.
Last night, the Department for Business, Enterprise and Regulatory Reform said it was prepared to review its position.
"The government is committed to monitoring any evidence that blacklisting is resurfacing in the UK," said a spokesman for the department. However, the information commissioner has powers to take action if he believes data protection laws have been broken.
His officials raided the offices of Kerr, the private investigator, in Droitwich, Worcestershire last week, seizing what the commissioner calls "an intelligence database" of 3,213 individuals.
Thomas said the "comprehensive card index system" held "sensitive" personal data, including details of trade union activity, employment conduct and personal relationships.
He added there was also information about whether the individual "may pose a threat to industrial relations between an employer and its employees". Some information was more than 30 years old, he said.
He has also seized invoices, which he says were issued by Kerr to companies for checking names on his database. He said they showed that the companies had paid Kerr an annual subscription and then a fixed fee for each name they wanted him to run through his database.
The Guardian understands that, in what appears to be a system for centralising records in the construction industry, companies sent information to Kerr so that it could be pooled with other firms.
Kerr agreed to close his business after the commissioner ordered him to stop selling the contents of the database on the grounds he had broken data protection laws.
Yesterday, Kerr said he was not operating a "blacklisting" service as he never made any judgments about the individuals and instead left it up to companies to decide whether to employ them.
Thomas launched his investigation last summer after an article in the Guardian about alleged blacklisting in the construction industry. The commissioner intends to order the construction companies to stop buying workers' personal data.
____________________________________________
“Show respect for personal data” warns pre-employment screening company Powerchex
The Information Commissioner’s Office is showing its teeth in a case that may spur far reaching regulation of companies that maintain and sell personal data.
As part of an investigation of the Guardian, The Information Commissioner’s Office closed down an investigating firm that was maintaining and selling data from an illegal database. Buyers of the information, which include some of the biggest construction firms in the UK, will also be prosecuted.
Yesterday David Smith, the deputy information commissioner, said: "This is a serious breach of the Data Protection Act. "Not only was personal information held on individuals without their knowledge or consent, but the very existence of the database was repeatedly denied [by the industry]. "The covert system enabled Mr Kerr to unlawfully trade personal information for many years, helping the construction industry to vet prospective employees. Kerr held information on thousands of construction workers and profited by checking names against his database."
“Companies have often shown a cavalier attitude on how they store, transmit and protect personal data” states Alexandra Kelly, Managing Director of pre-employment screening company Powerchex.
“Light sentences from the Information Commissioner, as well as a perceived impression that companies that break the code will not be prosecuted have resulted in a lax treatment of personal data including employee, customer and other such sensitive data.”
The Financial Services Authority, which regulates the UK financial services sector, recently issued a consultation paper to help firms ensure that they treat customer and employee data in a secure fashion.
Examples of good practice in terms of treating personal datas laid out in the report include:
· All customer/employee data to be disposed of securely using shredders or confidential waste bins
· Treating all data as confidential waste to eliminate confusion about which type of bin to use.
· Providing guidance for travelling or home-based staff on the secure disposal of customer data
· Conducting due diligence of data security standards at third-party suppliers before contracts are agreed
· Regular reviews of third party suppliers’ data security systems and controls
· Ensuring tht third-party suppliers’ vetting standards are adequate
· The use of secure internet links to transfer data to third parties
“Companies that handle personal data should make sure that third parties who process this data are also compliant with the Data Protection Act” says Kelly, “and of course, everyone must be registered with the Information Commissioner” she concludes.
________________________________________________________
The Guardian that broke the story after investigating reported:
More than 40 major British companies face legal action for allegedly buying secret personal data about thousands of workers they wanted to vet before employing them.
The information commissioner, Richard Thomas, will today publish a list of the companies he believes may have broken data protection laws, after an investigation by his office that was sparked by fears that many workers were being unfairly "blacklisted".
The commissioner alleges that the firms, including Balfour Beatty, Sir Robert McAlpine, Laing O'Rourke and Costain, have, for many years, covertly bought details of workers' trade union activities and their conduct at work.
Thomas believes that workers have been unfairly denied employment because they have had no chance of challenging any inaccurate information, some of which has been stored for decades.
Asked by the Guardian to respond to the claims, many companies refused to comment. Others denied using the data to "blacklist" troublesome workers covertly, or said they had stopped buying the data.
The commissioner has already taken action rapidly to close down a private investigator who is accused of clandestinely compiling an "extensive intelligence database" of 3,000 workers with details that stretch back to the 1980s.
The commissioner is to prosecute the private detective, Ian Kerr, who is accused of selling the information to companies in the construction industry when they wanted to vet potential staff. Thomas said he had seized documents which, he says, show that files on individuals included comments such as "communist party", "ex-shop steward, definite problems, no go", "do not touch", "orchestrated strike action" and "lazy and a trouble-stirrer".
David Smith, the deputy information commissioner, said: "This is a serious breach of the Data Protection Act. Not only was personal information held on individuals without their knowledge or consent, but the very existence of the database was repeatedly denied.
The covert system enabled Kerr to unlawfully trade personal information on workers for many years, helping the construction industry to vet prospective employees.
"Kerr held information on thousands of construction workers and profited by checking names against his database.
"Trading people's personal details in this way is unlawful and we are determined to stamp out this type of activity."
Construction workers have long complained that they have been stopped from getting work because companies were covertly turning away people they believed to be active trade unionists. Hard evidence has, until now, been hard to come by, and the construction industry has always denied it.
Steve Acheson, who believes he has been blacklisted, said he was "absolutely thrilled" by the findings of the commissioner's investigation.
The electrician, 55, from Denton in Manchester, said: "I've been angry for so long. It affects your character and demeanour - it's the fact it's so blatantly unjust. I was disgusted that one man could make a living from denying other men the right to work".
The Labour government has been criticised for passing a law banning the practice of so-called blacklists in 1999, but then, in a U-turn, deciding not to take the final step of implementing the law on the grounds that "there was no hard evidence that blacklisting was occurring". Technically, therefore, "blacklisting" is still legal.
Last night, the Department for Business, Enterprise and Regulatory Reform said it was prepared to review its position.
"The government is committed to monitoring any evidence that blacklisting is resurfacing in the UK," said a spokesman for the department. However, the information commissioner has powers to take action if he believes data protection laws have been broken.
His officials raided the offices of Kerr, the private investigator, in Droitwich, Worcestershire last week, seizing what the commissioner calls "an intelligence database" of 3,213 individuals.
Thomas said the "comprehensive card index system" held "sensitive" personal data, including details of trade union activity, employment conduct and personal relationships.
He added there was also information about whether the individual "may pose a threat to industrial relations between an employer and its employees". Some information was more than 30 years old, he said.
He has also seized invoices, which he says were issued by Kerr to companies for checking names on his database. He said they showed that the companies had paid Kerr an annual subscription and then a fixed fee for each name they wanted him to run through his database.
The Guardian understands that, in what appears to be a system for centralising records in the construction industry, companies sent information to Kerr so that it could be pooled with other firms.
Kerr agreed to close his business after the commissioner ordered him to stop selling the contents of the database on the grounds he had broken data protection laws.
Yesterday, Kerr said he was not operating a "blacklisting" service as he never made any judgments about the individuals and instead left it up to companies to decide whether to employ them.
Thomas launched his investigation last summer after an article in the Guardian about alleged blacklisting in the construction industry. The commissioner intends to order the construction companies to stop buying workers' personal data.
Subscribe to:
Posts (Atom)
