Zurich Insurance has been fined £2.275 million ($3.5 million)
for losing the bank and identity details of 46,000 policy
holders.

The fine is the highest levied by the Financial Services
Authority (FSA), the UK regulator, on a single firm for data
security failings. The FSA criticised Zurich for inadequate systems
and controls to prevent the loss of customers’ confidential
information, including credit card, bank account and identity
details.

The loss of 46,000 customers’ details dates back to 2008 when
Zurich Insurance Company South Africa (Zurich SA) lost an
unencrypted back-up tape during a routine transfer to a data
storage centre.

Zurich UK, who outsource the processing of some of its general
insurance customer data to Zurich SA did not learn about the loss,
which included personal details, card and bank account details and
information regarding insured assets, until a year later.

“Zurich UK let its customers down badly. It failed to oversee
the outsourcing arrangement effectively and did not have full
control over the data being processed by Zurich SA,” said Margaret
Cole, the FSA’s director of enforcement and financial crime.

While the loss could have led to fraud and financial loss for
its customers, Zurich UK has seen no evidence to suggest that the
personal data was compromised or misused.

How well do you really know your competitors?

Access the most comprehensive Company Profiles on the market, powered by GlobalData. Save hours of research. Gain competitive edge.

Company Profile – free sample

Thank you!

Your download email will arrive shortly

Not ready to buy yet? Download a free sample

We are confident about the unique quality of our Company Profiles. However, we want you to make the most beneficial decision for your business, so we offer a free sample that you can download by submitting the below form

By GlobalData
Visit our Privacy Policy for more information about our services, how we may use, process and share your personal data, including information of your rights in respect of your personal data and how you can unsubscribe from future marketing communications. Our services are intended for corporate subscribers and you warrant that the email address submitted is your corporate email address.

Zurich UK failed to take reasonable care to ensure it had
effective systems and controls to manage the security of customer
data and the firm also failed to ensure sufficient measures were in
place to prevent financial crime, the FSA said.

As Zurich UK agreed to settle at an early stage of the
investigation the firm qualified for a 30 per cent discount.
Without this discount the firm would have been fined £3.25
million.