Bank of Scotland fined over wrong delivery of customer details

Bank of Scotland has been fined £75,000 for repeatedly faxing customers' account details and personal information to the wrong people, The Guardian reported.

Over a three-year period, from February 2009, the bank misdirected information including payslips, bank statements, account details and mortgage applications, as well as customers' names, addresses and contact details.


At least 21 documents were sent to a third-party organisation that had a fax number one digit different to the intended recipient - a department in the bank which uploaded documents to its system. A further 10 were sent to a member of the public who also had a similar fax number.


The Information Commissioner's Office (ICO) said despite the first incident having been reported to the bank, and many other reports of mistakes, the bank had continued to misdirect faxes.


The ICO's head of enforcement, Stephen Eckersley, said the bank had continually failed to address the problems raised over its insecure use of fax machines.


"To send a person's financial records to the wrong fax number once is careless. To do so continually over a three-year period, despite being aware of the problem, is unforgiveable and in clear breach of the Data Protection Act," he said.


"Let us not forget that this information would have been all a criminal would ever need to carry out identity fraud. Today's penalty reflects the seriousness of this case."


A spokesperson for Bank of Scotland's parent company Lloyds Banking Group said: "The security of our customers' data is always our key priority. We apologise that, due to human error, a very small number of documents relating to 32 customers were unfortunately misdirected. This occurred over a period in which several million customer documents, using the same process, were correctly received.


"No customer suffered any harm or detriment as a result of this error. We are continually reviewing our processes to ensure our customers' information remains safe".


In June the ICO fined North Staffordshire Combined Healthcare NHS Trust for a mistake which led to it faxing the sensitive medical details of three patients to a member of the public instead of its Wellbeing Centre.