Finance and Insurance

Data protection adds additional complexity to the already heavily regulated Financial Services and Insurance sector. Many of the data protection law requirements are complementary to existing legislation but special attention must be made to personal data protection.

Finance and insurance companies often process large amounts of personal data, often of a sensitive nature.  Particular attention must be paid to ensure it is only used for the intended purpose, that it is only shared in a controlled way and that it is retained and disposed of appropriately and in a timely fashion.

The use of data for profiling and automated decision making is also strictly legislated under the GDPR and data protection act 2018.

Important data protection considerations for finance and insurance organisations

Finance and insurance organisations must protect personal data in a wide range of their operations. Some major considerations include:

Complementary Regulations, Does your data protection procedures and policy complement other regulations you have such as:

• Financial Conduct Authority (FCA) regulations
• PCI Credit card regulations
• Banking regulations
• Anti-money laundering regulations

Handling sensitive and special category data, what measure do you have for monitoring 

• PCI Credit card regulations
• Banking regulations
• Anti-money laundering

Managing sensitive and special category, how do you:

• Carry out a Data Protection Impact Assessments
• Manage who can view or processes: Personal data, financial data, medical data, records of criminal convictions especially for Insurance

Multiple and legacy systems, what do you do about:

• Duplicated data held on multiple systems and data minimisation
• Data retention and disposal
• Mechanisms for handling DSARs (Data Subject Access Request)

Policies and Administration, what policies are in place for

• Email systems
• Staff payroll, pension and HR records
• Visitors’ book, access and CCTV
• Data Security
• Maintaining network and server security
• Data encryption
• Cyber security 
• Privacy, cookie and terms of use website policies
• Sharing data with others
• Transfers with 3rd parties 
• Data transfers outside the EU
• Data processing and data sharing agreements

What does the legislation mean for finance and insurance organisations?

Like all other organisations, finance & insurance organisations must:

Be transparent in the way they process personal data and accountable for doing so

Be able to detect, manage, report and respond to data breaches including, if necessary, liaising with the supervisory authority such as the Information Commissioner’s Offfice (ICO)

Understand the data they have, where it is stored and who has access to it

Implement robust processes and procedures to protect personal data

Allow users, data subjects and staff to:

• Access the data stored on them
• Ensure the data is correct and modify it as necessary
• Have it deleted (unless needed for legitimate reasons)

Appoint a designated data protection officer if they:

• Are a public body
• Process data on a large scale
• Use the data for profiling or automated decision making

All business should appoint a designated person for data protection. It would be considered best practise to have Data Protection Officer even if you are not mandated to have one

Enquire today about how DPO Assist could support your sector in achieving compliance.