Chesnara Life (UK) Limited

FCA action

fine

1

in fines

£1.16m

most recent

July 2009

• Fined £1.16m on 22 July 2009

  On 17 July 2009 the FSA imposed a financial penalty of £1,160,000 on HSBC Life (UK) Limited for breaches of the FSA's Principles which occurred between 1 January 2006 and 28 March 2008 in relation the systems and controls in place to manage the risks relating to data security, specifically the risk that confidential customer data might be lost or stolen. HSBC Life agreed to settle at an early stage of the FSA's investigation. It therefore qualified for a 30% (Stage 1) discount under the FSA's executive settlement procedures. Were it not for this discount, the FSA would have imposed a financial penalty of £2,300,000 on HSBC Life. Within particular parts of its business, HSBC Life failed to undertake an adequate assessment of the risks relating to data security, failed to assess whether its existing controls were adequate to manage these risks, and failed to implement adequate and effective procedures, guidance, training and monitoring to address these risks. In particular HSBC Life failed to ensure that one of its departments had in place adequate and effective procedures, guidance and resources to ensure that: (1) customer data sent to third parties on portable electronic media (e.g. CDs, disks and USB devices) was secure in the event that the data was lost or intercepted; and (2) customer data kept in its offices was at all times secure from the risk of internal fraud or theft. HSBC Life's failure to properly assess these risks and to implement robust systems and controls to deal with them increased the risk that its business could be used for purposes connected with financial crime and exposed its customers to the risk of being victims of financial crime. The weak controls surrounding data security resulted in practices that placed customer data at risk of loss or theft in that: (3) HSBC Life's Finance department routinely sent unencrypted CDs containing significant amounts of confidential customer data to third parties by unrecorded delivery; and (4) notwithstanding that access to the firm's offices was securely restricted, confidential customer data held by the same department was routinely kept in unlocked cabinets. This included unencrypted electronic copies of more than 740,000 live policies and over 1 million non-live policies. These failures contributed in February 2008 to the loss by HSBC Life's Finance department of an unencrypted CD sent through the post by unrecorded delivery. The CD contained confidential data of 180,000 policy holders. Although some technical skill was required to interpret the data, it included names, ages, sex, dates of birth, smoker status, policy numbers, the same details for joint policy holders, premia and sums assured. Although a member of staff was aware that the CD had not arrived on 11 February 2008, its loss was not formally escalated within HSBC Life until over a month later, on 20 March 2008. The FSA considers these failings to be particularly serious because: (1) During the Relevant Period, HSBC Life had over 740,000 customers. This included not only individual customers but also corporate customers where large numbers of individuals participated in corporate life, investment and insurance schemes or policies. All of these individuals are entitled to rely on HSBC Life to take reasonable care to ensure the security of customer data entrusted to it. The failure to have appropriate data security controls had the potential to expose these individuals to the risk of identity theft and financial loss. (2) The failures occurred following a period of heightened awareness of financial crime issues as a result of government initiatives, increasing media coverage and a FSA campaign about the importance of financial crime within the financial services sector. Further, HSBC Life was aware that data security and the associated risks of fraud and identity theft were increasing problems for the financial services industry but failed to take suffient steps within the Relevant Period to ensure that all of its data security procedures were adequate and robust enough to prevent customer data being mislaid and potentially released into the public domain. The cumulative impact of the failings represented a material risk to the FSA objective of protecting customers and reducing financial crime. HSBC Life's failures therefore merit the imposition of a significant financial penalty. In deciding upon the level of disciplinary sanction, the FSA recognises that: (1) in response to the data loss incident HSBC Life reported the matter to the FSA, contacted all 180,000 individuals affected by the data loss and strengthened its caller identification procedures; and (2) the firm subsequently notified the FSA about deficiencies in its controls surrounding data security. In addition, HSBC Life has taken significant and proactive steps since the data loss incident to revise its procedures and controls, which have served to mitigate the seriousness of its failings. In particular, the firm has: (1) provided for compulsory encryption on all electronic data transfers and given clear instructions to its staff on when and how to apply encryption; (2) enhanced physical security in its offices by installing lockable cabinets in every office; (3) enhanced data security awareness by revising induction training for new staff and requiring all existing staff to undertake annual data security refresher training; (4) introduced an Information Security forum as a sub-committee to the formal risk committee structure; (5) implemented procedures to further restrict the ability to download data to portable devices; and (6) introduced the dedicated role of Business Information Risk Officer, including assessing ongoing performance against 18 key information risk indicators. HSBC Life has also co-operated fully with the FSA in the course of its investigation.