Norwich Union Life fined £1.26 million for data risks

gallery

Norwich Union Life has been penalised to the tune of £1.26 million by the Financial Services Authority (FSA) for failing to put the relevant systems and controls in place to protect customers' confidential data and mitigate financial crime risks.

As a result of these weaknesses, customers were exposed to actual and attempted fraud, leading to - in 2006 - fraudsters manipulating the data they were able to obtain in order to pocket £3.3 million due to the surrender of 74 Norwich Union Life policies, according to the FSA.

Following an investigation, the FSA ruled that Norwich Union Life hadn't adequately assessed the risks posed to its business by the threat of financial crime, meaning its customers were more likely to fall prey to fraudsters involved in criminal financial activity such as identity theft.

"Norwich Union Life let down its customers by not taking reasonable steps to keep their personal and financial information safe and secure," said Margaret Cole, director of enforcement at the FSA.

"It is vital that firms have robust systems and controls in place to make sure that customers' details do not fall into the wrong hands. Firms must also frequently review their controls to tackle the growing threat of identity theft. This fine is a clear message that the FSA takes information security seriously and requires that firms do so too."

The FSA's investigation, during which Norwich Union Life fully co-operated, also revealed that, despite operating in a time of increased sensitivity to information security, it failed to address the problems highlighted by the frauds, in "an appropriate and timely manner even after they were identified by its own compliance department."

Since the exposures, Norwich Union Life has worked to remedy the shortcomings, including reviewing information security processes and co-operating with the police to bring the fraudsters to justice.

"We are sorry that this situation arose and apologised to the affected customers when this happened. We have extensive procedures in place to protect our customers but in this instance weaknesses were exploited and we were the target of organised fraud," Mark Hodges, chief executive of Norwich Union Life, said in a statement.

"Whilst the number of customers affected is very small compared to the number of policies we manage overall, any breach in customer confidentiality is clearly unacceptable. Our customers can, however, be assured that we have taken this matter extremely seriously and have thoroughly reviewed our systems and controls as a result. All of our 7 million customers are protected by our promise that they will be fully reimbursed and will get help and support if they are the innocent victims of fraud."

The £1.26 million fine takes into account an early executive settlement agreement struck between Norwich Union Life and the FSA. Without the accompanying 30 per cent discount, the financial institution would have had to shell out £1.8 million to cover the fine.

* DVLA loses three million data records - click here to read.

Email to a friend

Print this page