Complaint against D - excessive information sought regarding Savings Account [2005] IEDPC 7 (31 December 2005)
I received a complaint against D Bank that unnecessary personal data relating to employment and salary were asked for by the Bank on opening a Savings Deposit Account.
My Office took this up with the Bank, acknowledging that the Bank has responsibilities under the Criminal Justice/Money Laundering Act to collect a certain amount of data when an individual is opening a bank account e.g. name, address, previous address, date of birth, gender. However, the Bank was advised that personal data relating to the individual's employment and salary would be considered by this Office to be excessive data when opening this type of an account, having regard to section 2(1)(c) of the Data Protection Acts which provide that data 'shall be adequate, relevant and not excessive' in relation to the purpose for which it is kept.
The Bank stated that its purpose in collecting the information was to 'allow us to shape our relationship with the customer into the future. It also gives us the opportunity to inform customers on the automated/electronic options available to them to meet their daily banking needs, while simultaneously giving them the comfort of knowing that they can contact their relationship manager for any of their future financial needs. By operating a customer consultant fact-find process when opening new accounts, we can better assess the customers financial needs now and in the future'.
Following further correspondence, the Bank advised this Office that they had circulated training manuals to all branches in November, 2005 highlighting the difference between mandatory information and information that would be excessive to ask for. In addition, the Bank informed this Office that a new Savings Account opening form was to be launched in February 2006.
I was satisfied that the Bank were aware of their responsibilities under the Acts and appreciated the prompt manner in which they addressed this issue.
The guiding principle always must be that no more information than is necessary for the purpose should be collected from the data subject.