I just ran across a story from last Friday, August 18.

"ROYAL Bank of Scotland and its NatWest subsidiary were today being investigated for allegedly dumping customers' financial details in bins. The Information Commissioner's Office (ICO) is looking into claims that both banks breached data protection rules. It follows a complaint from the consumer group Scamsdirect which apparently found customers' financial details in bins near two banks in Hampshire. A spokesman for the ICO said: "Clearly, where personal information is not disposed of securely, there is a risk that it will fall into the wrong hands. "We have launched an investigation to establish just what has happened."

Scamsdirect claims it found cut-up credit and debit cards, money deposit details and bank account information in bins near bank branches in Fareham and Southampton.  A spokesman for RBS confirmed the bank had been contacted by the ICO about the complaints. He said: "We take the disposal of customer and bank confidential waste extremely seriously and have procedures in place for the secure storage and disposal of confidential information. "The bags removed by Scamsdirect from our Fareham branches, were general waste bags taken from our dustbins outside the branches."

Identity theft, where fraudsters get hold of personal information and use it to buy goods without the victim's knowledge, is estimated to cost the UK economy £1.7 billion."

Scamsdirect looks like an interesting organization.  Businesses certainly would like to stay out of their sights.  However, when oversight agencies don't enforce the laws, it is good to know there are groups such as this exposing privacy risks that should not even exist with proper policies and procedures.

The Royal Bank of Scotland is a large company; but their posted privacy and security policies only apply to their website.

Even though the sensitive information was "cut-up" it is implied from the report that the information itself was still easy to ascertain.

Well, although the Royal Bank of Scotland says they "take the disposal of customer and bank confidential waste extremely seriously and have procedures in place for the secure storage and disposal of confidential information" it appears these procedures have not been well communicated to their personnel. 

FYI:  £1.7 billion is approximately equal to US$3.21 billion.

This is one more example for your awareness files of how incidents happen when improperly disposing sensitive information.  The bad press definitely did not help their business, or create trust with their customers.

Technorati Tags
information security
IT compliance
data disposal
identity theft
regulatory compliance
policies and procedures
awareness and training
privacy