Bank of Ireland UK reprimanded for inaccurate data on customers’ accounts

According to the data protection regulator, the firm sent incorrect outstanding balances on customers’ loan accounts to credit reference agencies, which could have potentially led to these customers being unfairly refused credit for mortgages, credit cards or loans, or granted too much credit on products they were potentially unable to afford.  

Its investigation also found that, due to the complex nature and different factors contributing to credit scoring, it would be impossible to determine the actual damage caused to each customer. However, the ICO concluded it was reasonable to assume it would have had a negative impact on the customers affected.  

The breach was reported to the regulator in March 2021, with the bank found to have been breach of protection law by failing to ensure personal data was accurate.  

The ICO’s head of investigations Natasha Longson said: “Mistakes made by financial institutions can have far-reaching consequences on people’s everyday lives.  

“Some of the customers affected could have been refused mortgages, loans or credit cards, as well as being unable to get mobile phone contracts, insurance policies or sign up with utility companies. The mistake made by Bank of Ireland UK could have potentially caused misery for thousands of people.  

“We do however recognise the steps the bank has taken to correct their error, supporting affected customers and reviewing its data-management processes. Therefore, we believe a reprimand is the best, fairest outcome, and that lessons have been learnt to avoid mistakes like these in the future.”   

Steps recommended in the reprimand by the ICO include continuing to support affected customers, ensuring that robust processes are in place, and are reviewed regularly, and that learnings are shared across the organisation to prevent a repeat of the issue.

Credit Strategy has reached out to the Bank of Ireland UK for comment. In response, they said: "Bank of Ireland UK acknowledges the Reprimand from the Information Commissioner’s Office. We take very seriously our regulatory and compliance obligations, and our duty to customers and regret  that we fell short in this instance.

"The Bank has rectified the technical issue which caused the errors and introduced additional checks to improve data management and oversight.

"Once we identified and reported the issue, we engaged fully and proactively with the Commissioner throughout the investigation."