Which? calls for ICO action as report shows UK banks failing on data protection

Consumer rights organisation Which? has called on the Information Commissioner's Office (ICO) to get tougher on UK banks after it was revealed that over 500 data protection complaints have been lodged with the watchdog over a 12-month period.

The Freedom of Information request showed that 515 complaints were lodged with the watchdog about possible data protection breaches by eight of the UK's biggest banks and building societies between August 2009 and August 2010.

Barclays was the worst culprit with 116 complaints, followed by Lloyds TSB with 114 and Santander with 103.

Customer complaints centred mainly around problems with subject access requests, whereby the banks in question failed to provide accurate copies of the data held on customers in a timely manner.

The banks were also accused of holding inaccurate data, disclosing that confidential data to third parties and having poor security measures in place on internet or phone banking systems.

"We think that the ICO should be tougher on these companies," a Which? spokesman told V3.co.uk.

"The number of complaints has actually gone up, while for other organisations dealing with people's data, the number of complaints has gone down, so obviously we need to stop them doing this kind of thing."

The perils of unauthorised data disclosure are well versed, but Which? also argued that holding inaccurate customer data could have a serious impact on customers, for example by affecting credit ratings or mortgage applications.

An ICO spokesperson argued that the number of complaints upheld is small compared to the millions of bank accounts in the UK, but nonetheless identified the sector as one of the watchdog's priority areas.

"We are working closely with this sector to help them make improvements, and have been encouraged by their willingness to take action," the spokesperson said.

"Where we encounter systemic problems, we are committed to taking appropriate regulatory action, including imposing financial penalties in the most serious cases."

The ICO also said that any individual customers suffering a data breach should first exhaust the bank's complaints procedure, and pointed to its own Credit Explained guide on how to seek compensation through the courts.