The Consumers’ Association of Ireland  
   Independently Representing Consumers since 1966

                      The Consumers' Association of Ireland is a wholly independent, non-profit,
                    non-government organisation registered with charitable status. CHY No. 8559.

  PRESS RELEASE

CAI calls for compensation to consumers for personal information exposure.

   When consumers make an error they pay.

When banks make an error they should pay, not give consumers spin.

The Consumers' Association of Ireland (CAI) is today calling on the Bank of Ireland to pay compensation following the revelation this week that the personal financial and health information of 10,000 of their customers had been stolen through the theft of a number of laptops.
Given the much more serious nature of the present data exposure CAI is calling for compensation for each of the consumers whose medical and financial information is now in the hands of criminals. CAI believes that there is already a precedent for this as the Bank of Ireland (BOI) reluctantly provided €4,000 compensation to a consumer for a single incident of data exposure in the past when a bank letter was incorrectly addresses and opened in error by the recipient.
Doubtless some consumers will find this amount totally inadequate and, depending on the information exposed, and may justifiably seek a substantial multiple of this amount through other means.
The Bank's laissez faire attitude, late apology and spin when the story broke show a scant disregard for customers and are grossly inadequate.
The data held was not encrypted. The cost of encryption per laptop is miniscule. Encryption software has been available for as long as computers have existed. This lack of encryption shows a Euro-pinching attitude to protecting its customers. The financial institutions spent millions on the chip and pin introduction to save themselves money, but could spend a fraction of that to protect their customer’s data.
The months of delay in reporting the thefts is further evidence that securing consumer medical and financial information is not on the bank's priority list. The further six-week delay in reporting the loss shows a cavalier attitude toward the Regulators.  This above the law attitude needs to be eliminated. It must be borne in mind that these consumers will have to live forever with the concern that at any time in the future their medical information may be used against them.
CAI is also now calling on all other financial institutions, utility companies and others who retain sensitive personal data to confirm that there has been no loss or theft of customer’s information which has not already been notified to the affected consumers and the Data Protection Commissioner.

*********************************************

Dermott Jewell, the Associations CEO, pointed out that: “The confirmation that the laptops, stolen between June and October of last year, contained not only personal and sensitive medical and life assurance details but also bank account name, address and other details, indicates an abysmal lack of priority or concern in the protection of its customers by BOI. But it is the delay in advising those consumers that speaks volumes.” 

 “We believe that the only way to change attitudes in the Bank of Ireland and other financial institutions is that they pay the penalty in monetary terms, which should ensure they take data protection much more seriously in future”, concluded James Doorley, Chairman of the Consumers’ Association of Ireland.

Embargo to midnight Saturday April 26th
Ends.