Bank of Ireland fined €463,000 over the corruption of information

Bank of Ireland has been slapped with a fine of €463,000 by the Data Protection Commission (DPC) for several data breaches between November 2018 and June 2019, which potentially affected nearly 50,000 customers and their credit ratings.

The DPC investigated the series of data breaches related to the corruption of information in the bank’s data feed to the Central Credit Register, a centralized system that collects and securely stores information about loans, found that thousands of unauthorized disclosures and accidental alterations of customer personal data which could have damaged the customers’ credit ratings and prevented them getting loans.

In some cases, incorrect information was entered into customers’ files, indicating that they were “in financial distress” when they were not. Banks use credit reports submitted by a bank on customer loans to get a picture of a person’s current lending and credit history. A bank uses this information to decide whether it should approve a loan application or not.

The DPC received 22 breach notifications from the Bank of Ireland between November 9, 2018, and June 27, 2019, regarding the bank’s corruption of information sent to the Central Credit Register. Nineteen of these reported incidents met the definition of “personal data breach” under the General Data Protection Regulation (GDPR), the EU’s law on data protection and privacy.

The bank was fined for the breaches and the delays in communicating with affected customers. In addition to the €463,000 in fines, the DPC issued the Bank of Ireland a reprimand and has ordered it to bring its processing into compliance with data protection regulations.

The Bank of Ireland said in a statement that it fully acknowledges and sincerely apologizes for the breaches. It said it notified all affected customers and had rectified the inaccurate information in all but 20 cases, which will be corrected shortly.