The UK data regulator has confirmed that it does not intend to impose penalties following a widely reported data breach involving a high-profile customer of a NatWest Group division.
The UK data protection regulator the Information Commissioner’s Office (ICO) has upheld a complaint that banking corporation NatWest Group breached data protection rules when it disclosed information about a high-profile individual’s banking arrangements.
Former MEP and UK Independence Party leader Nigel Farage revealed in June on the microblogging platform X (formerly known as Twitter) that his bank account had been closed ostensibly for commercial reasons. The bank was later identified as NatWest’s high-net-worth-focused subsidiary Coutts, where every British monarch since King George IV has held an account.
Further media reports followed, conjecturing that Farage’s ‘politically exposed person’ status may have been behind the de-banking decision, that he had not maintained the minimum balance required to access the bank’s services, and that his political viewpoints did not influence the decision.
But little could have prepared for the explosive revelations following Farage’s demand that the bank provide copies of his personal information – known as a subject access request – which revealed staff had carried out extensive research that suggested their continued relationship could result in serious reputational harm to the bank, and that his political and personal opinions were at odds with the institution’s ethos, along with criticism of his association with former US President Trump.
Dame Alison Rose subsequently resigned in July as NatWest Group’s chief executive following her admission she had spoken to a journalist about Farage’s banking arrangements, with the resignation of Coutts’ division head Peter Flavel following shortly thereafter. The bank has since confirmed that Dame Alison will receive one year’s salary plus a bonus, bringing her severance payout to GBP 2.4 million.
NO FURTHER ACTION
Despite the regulatory infringement, the ICO is not looking to impose any regulatory sanctions in connection with the data breach, holding that Coutts’s own investigation and the subsequent resignation of senior personnel are sufficient to bring the matter to a close.
An ICO spokesperson confirmed the report in question was a response to a complaint by an individual and thus would not normally be shared publicly, but did provide a statement: “Following a thorough review of the complaint raised with us, we have concluded our investigation. We upheld two parts of the complaint – namely, we found that an individual employed by NatWest shared information when they should not have done, and that by doing so they infringed the complainant’s data protection rights.”
The statement continued: “We have been clear with the bank that these actions were unacceptable and should not happen again. However, in view of the fact the individual in question resigned her post and the bank has commissioned its own investigation, we do not intend to take any further regulatory action at this time.”
