1. CISI – Financial Products, Markets & Services
Topic – Financial Services Regulation and Professional Integrity
Lesson:
8.4 Data Protection and
8.5 Complaints and Compensation

2. Examples of data losses

3. Complying with the Data Protection Act
Financial Services Firms that hold and process personal data must be registered with the Information Commissioner
The firm is described as the Data Controller
Notify the Information Commissioner that they are processing information
Process personal information in accordance with the 8 principles of the Act
Answer subject access requests from individuals
Legal requirements

4. 8 Principles of the Data Protection Act
Customer information should be...... 1
Processed fairly and lawfully 2
Obtained for one or more specified and lawful purpose and shall not be processed in any other way 3
Accurate and kept up-to-date 4
Kept for no longer than necessary 5
Processed in accordance with the rights of the subject 6
Adequate, relevant and not excessive for the purpose(s)
Protected against unauthorised & unlawful processing, accidental loss, destruction or damage using adequate technical and organisational methods 7 8
Protected against it’s transfer outside of the European Economic Area unless the country ensures it’s protection.

5. Regulatory Recommendations for keeping data safe
Employees should not have access to data beyond what is necessary to do their job.
Firms should look to monitor and control all flows of information into and out of the organisation.
Removable media should be disabled except when there is a genuine need.
Unauthorised staff should not be able to remove information undetected
Laptops and other portable devices should be encrypted and wiped when no longer used. Devices should be logged and monitored.
Software that tracks all activities should be installed (including web surfing and traffic)
Carry out due diligence on any 3rd party suppliers before agreeing contracts
All visitors to the firm’s premises should be logged in and out and supervised while on site.

6. Complaints and Compensation
Complaints are inevitable – sometimes they are valid, sometimes not.
The FCA requires authorised firms to deal with complaints from eligible complainants (Individuals and small businesses) promptly and fairly.
Firms need....
Written procedures staff must follow if a complaint is made:
Make a definitive response to the complaint
Reasonable timescale to resolve it
If a complaint is verbal or written
If a complaint is justified or not
Can be followed even for an ‘ineligible’ complainant (business client)
Those making a complaint should.....
Receive an acknowledgement of the complaint in a timely manner
Receive a response to the complaint
Have their complaint appropriately investigated
Be made aware of their rights to go to the Financial Ombudsman Service
Receive a final response within 8-weeks of the date of the complaint

7. Internal Complaints Procedures
Employees appointed to handle the complaint
must have sufficient competence.
must not have been directly related or involved.
must have the authority to settle the complaint.
must adequately address the complaint and offer redress where appropriate.
must offer fair compensation (address consequential or prospective loss as well as actual loss)

8. The Financial Ombudsman Service (FOS)
Under the FSMA and FCA, the FOS has the power to make rules relating to handling complaints.
The FOS is designed to resolve complaints about financial services firms quickly and simply
Characteristics of The Financial Ombudsman Service (FOS)
Offers an independent view
Complainants can use this when dissatisfied with a firm’s final response.
Operates a dispute resolution scheme.
FOS decisions are binding for firms but not for the complainant.
Fair compensation may be payable – no more than £150K

9. The Financial Services Compensation Scheme (FSCS)
If retail banks were to collapse, savers could potentially lose their deposited money.
This would create uproar and undermine confidence in the financial system – people would no longer want to keep their money in a bank account.
Northern Rock savers withdrawing their money in September 2007
Function of The Financial Services Compensation Scheme (FSCS)
Pays out compensation to eligible complainants in the event of a default of an authorised firm. (Excludes professional customers)
Similar to an insurance policy paid for by all authorised firms.
Compensation:
Firms in default – 100% of the first £50K per person per firm for investments.
£75K for bank deposits