Laying the foundations

The FSA is addressing data security risks with firms through ongoing supervision and is increasing its visits to small firms to review their systems and controls. It is also publishing a factsheet to help senior management at small firms understand their data security responsibilities.

In June, the FSA fined a firm of stockbrokers £77,000 for not adequately protecting its customers from the risk of identity fraud. This was the first time the FSA had fined a stockbroking firm for weak data security controls. I doubt it will be the last.

Despite increased awareness of data security issues, there are frequent incidences of carelessness that would horrify anyone with even a rudimentary grasp of TCF.

The FSA does not expect firms to be perfect, but it will certainly have serious complaints about those who are making no real efforts to move in that direction, as demonstrated by their actions in June. Gaining appropriate training in this area is one way in which such commitment can be demonstrated.

To successfully complete the Certificate in Regulated Customer Care, candidates must be able to demonstrate an understanding of the Data Protection Act, Freedom of Information Act and the Privacy and Electronic Communications Act, all of which have significant impacts on this area.

Put simply, CeRCC more than adequately addresses the issues highlighted by the FSA and should be considered as an option for those wanting to ensure they have a thorough understanding of the legal and regulatory requirements in this area.

However, firms and individuals should be undertaking such training not just because it helps meet regulatory requirements but because it adds value to their organisation by ensuring customers are treated fairly at all times.

Mark Roberts is head of financial regulation for the ifs School of Finance