240 likes | 366 Views
Data Protection in Financial Services Are you Seeing the Bigger Picture?. 17 September 2008. Disclaimer. This presentation does not constitute specific legal advice This talk is to raise awareness – not to solve specific problems Opinions, errors and omissions are the speaker’s alone
E N D
Data Protection in Financial Services Are you Seeing the Bigger Picture? 17 September 2008
Disclaimer • This presentation does not constitute specific legal advice • This talk is to raise awareness – not to solve specific problems • Opinions, errors and omissions are the speaker’s alone • This talk is designed to engender discussion about the risks associated with data security within the FSA regulated sector
Rules, rules and more rules… • Data Protection Act 1988 • The Human Rights Act • Telecommunications (Lawful Business Practice) Interception of Communications Regulations 2000 • Companies Act • Freedom of Information Act • ….
Data Protection Act 1998 “personal data” means data which relate to a living individual who can be identified— (a) from those data, or (b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller, and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual. Section 1 Data Protection Act 1998
Data Protection Principles • The Data Protection Act 1998 - ‘The Eight Principles’ • Fair and lawful processing • Obtained for one or more lawful process • Adequate, relevant and not excessive • Not kept for longer than is necessary • Processed in accordance with the data subject’s rights • Appropriate technical measures to prevent unauthorised access, loss , damage or destruction • No non-EEA data transfers without adequate levels of protection of data subject’s right
FSA Statutory Objectives • Statutory Objectives • market confidence: maintaining confidence in the financial system; • public awareness: promoting public understanding of the financial system; • consumer protection: securing the appropriate degree of protection for consumers; and • the reduction of financial crime: reducing the extent to which it is possible for a business to be used for a purpose connected with financial crime.
The FSA’s approach to regulation • Risk based compliance • Large firms = safe? • Small firms = risky? • Principles based compliance • No rule to point to • One size doesn’t fit all
Regulatory overlap: FSA v ICO • Fair and lawful processing • Obtained for one or more lawful process • Adequate, relevant and not excessive • Not kept for longer than is necessary • Processed in accordance with the data subject’s rights • Appropriate technical measures to prevent unauthorised access, loss , damage or destruction • No non-EEA data transfers • Statutory objectives
Regulatory overlap: FSA v ICO • Principles for Business • Principle 3 – Systems and Controls • Principle 6 – Customer’s Interests • Principle 10 – Protection of Client Assets • Fair and lawful processing • Obtained for one or more lawful process • Adequate, relevant and not excessive • Not kept for longer than is necessary • Processed in accordance with the data subject’s rights • Appropriate technical measures to prevent unauthorised access, loss , damage or destruction • No non-EEA data transfers
Regulatory overlap: FSA v ICO { • Fair and lawful processing • Obtained for one or more lawful process • Adequate, relevant and not excessive • Not kept for longer than is necessary • Processed in accordance with the data subject’s rights • Appropriate technical measures to prevent unauthorised access, loss , damage or destruction • No non-EEA data transfers • Current initiative – ‘Treating Customers Fairly’
Stuff the ICO, the FSA is the new data protection regulator! ICO: £5,000 fine; personal liability for company officers; imprisonment FSA: unlimited fines; personal liability for Approved Persons
ISO 27002:2005 – Code of Practice for Information Security Management • Risk Management 2. Security Policy 11. Business Continuity 12. Compliance 3. Organization of Information Security 10. Incident management Data Management 9. Information Systems Acquisition, Development, Maintenance 4. Asset Management 5. Human Resources Security 8. Access Control 7. Communications and Operations Management • Physical and Environmental Security
Their loss is your [potential] loss • HBOS • Alliance & Leicester • Royal Bank of Scotland • Scarborough Building Society • Clydesdale Bank • Natwest • United National Bank • Barclays Bank • Co-operative Bank • HFC Bank • The Post Office • CGNU • BNPP Private Bank • Nationwide Building Society • Capita Financial Administrators • Merchant Securities Group • …to be continued?
Steven Harrison • John Shelvin • Mail Source/Graphic Data • …
The true cost of good data managementHow to get senior management buy-in • Protecting the firm’s reputation – 99% • Protecting the firm’s assets - 84% • Improving efficiency/cost reduction – 75% • Enabling business opportunities - 68% Source: BERR 2008 Report
Think laterally, not literally! • Risk assess • Draft, implement and test policies and procedures • Train your staff appropriately • Read widely from multiple sources , and assess relevance to your firm.
Further Reading • FSA Data Security in Financial Services Report – April 2008 - http://www.fsa.gov.uk/pubs/other/data_security.pdf • The BERR 2008 Information Security Breaches Survey - http://www.berr.gov.uk/files/file45714.pdf • FSA Enforcement Action Final Notices - http://www.fsa.gov.uk/Pages/Library/Communication/Notices/Final/ • Information Commissioner’s Office Enforcement Actions - www.ico.gov.uk/what_we_cover/data_protection/enforcement.aspx • Information Commissioner’s Office Good Practice Guides - http://www.ico.gov.uk/tools_and_resources/document_library/data_protection.aspx
Further Information or Assistance Email: Elizabeth.Nelson@b2bregulatorysupport.co.uk Website: www.b2bregulatorysupport.co.uk Tel: 0870 042 1048