The governor of the Bank of Ireland has said he is “horrified” by the theft of four laptops containing confidential information of 10,000 customers.
The four laptops were stolen between June and October last year. One laptop was taken from a Bank of Ireland branch, while the other three were stolen from cars.
The information on the computers includes names and address, financial details and some medical records of the bank's life assurance customers.
B of I said none of the stolen information was encrypted, although lesser forms of security, such as password protection, were in place. The bank said it had been monitoring the customer's accounts since their records were stolen and there was no evidence of any fraudulent or suspicious activity.
Speaking in Belfast today, B of I governor Richard Burrows blamed an “internal bungle” for the situation, which he said left him “horrified”.
“There has been a very serious internal lapse and we have an investigation underway to find out why it was so,” Mr Burrows said.
No member of staff has yet been suspended over the loss of the sensitive data, the governor said. It was much too early for disciplinary action as the investigation had only started, he said.
The 10,000 customers involved had either been given a quote or taken out a life assurance policy with Bank of Ireland Life at seven branches around the country.
The branches affected are Bagnelstown and Courts Place in Carlow; Drogheda and Dunleer in Co Louth; and Montrose, Stephen’s Green and Tallaght in Dublin. The bank said it would be writing to these customers over the coming days.
Managing director of Bank of Ireland Life Brian Forrester told RTÉ radio this morning there was a “systems failure and a procedural failure which we are now tackling and managing.” He said the bank was in the process of fully encrypting all its laptops.
“Bank of Ireland apologises to customers and is committed to moving as quickly as possible to allay the concerns of affected customers,” the company said in a statement last night.
A spokeswoman for the bank said a helpline set up for customers this morning had received a "steady stream" of calls.
The Data Protection Commissioner Billy Hawkes said this morning he was only informed of the thefts last Friday and would be carrying out an investigation. The bank also informed the Financial Regulator last week.
The Financial Regulator said in a statement said it expects financial institutions to comply with all aspects of the law and regulatory requirements. "Any failures which impact negatively on consumers are of particular concern. The issue relates to one of compliance with Data Protection Regulations and so is appropriately dealt with by the Data Protection Commissioner with whom the Financial Regulator is co-operating," the statement said.
Labour deputy leader Joan Burton said the incident was “unacceptable and represents a lamentable display by the bank.”
“I am calling on the Financial Regulator and on the Information Commissioner to make a clear statement on the implications of these security breaches,” she added.
“It’s worth noting that similar case in the UK last year resulted in the Nationwide Building Society being fined over €1m when they failed to report the theft of one laptop in a timely manner. We now need similar sanctions here so that banks will take this matter seriously.”
Fine Gael’s communications spokesman Simon Coveney said all organisations dealing with sensitive personal information must adhere to rigorous procedures in their use of this data.
“Fine Gael hopes to work closely with the Data Commissioner to see how his powers of investigation and enforcement can be strengthened to protect consumers in this area,” he said.
He called for the mandatory encryption of all sensitive personal data carried portably; and for the strengthening of the Data Commissioner’s powers to investigate and enforce regulations, even where a complaint has not been made.
The Bank of Ireland help-line can be reached on 1850 365 365. It will be open between 9.00am and 6.00pm from Monday to Friday.