Irish banks to face data protection scrutiny after "serious errors" by AIB

Deputy Data Commissioner Gary Davis was speaking in an interview with national broadcaster RTÉ this morning. AIB had reported missed weekly or fortnightly repayments by about 12,000 of its customers to the Irish Credit Bureau as missed monthly repayments, making their credit histories appear worse than they should have been.

The errors, which occurred over a six-year period leading up to July 2012, were reported to the Data Protection Commissioner when it was identified in May, according to the bank.

Davis told RTÉ that the bank had supplied "inaccurate personal data", in breach of the country's data protection laws, to the ICB. The ICB is the body that gathers the information lenders use to decide whether or not to lend money to customers. As a result, Davis said, those customers may have been unfairly turned down for credit.

In a statement provided to Out-Law.com, AIB said that the error affected loan accounts where scheduled repayments were missed by customers with weekly or fortnightly repayment schedules. It added that all historical payment records held by the Bureau had since been corrected, while system changes had been made by the bank to prevent a repeat of the incident.

"The reporting error resulted in an incorrect statement to the ICB of the affected customer's repayment history," AIB said. "AIB reported the number of missed weekly or fortnightly payments rather than the number of equivalent months, as required by the ICB. This is an error which should not have occurred and AIB wishes to sincerely apologise for any inconvenience caused to customers as a result."

The bank has written to affected customers to inform them of the issue, and has offered to request new copies of Credit Bureau statements at AIB's expense.

A spokesperson for the ODPC told Out-Law.com that its investigation was "ongoing".

"The first phase of our investigation focused on ensuring that the inaccurate data was corrected as soon as possible and AIB has assured us that this has taken place," She said. "We were also anxious to ensure that AIB informed affected customers whose ICB record had been accessed during this period."

She added that a "detailed audit of leading financial institutions" to identify whether similar issues arose would begin "over the next couple of months".

The ODPC does not currently have the power to levy fines in respect of this kind of data breach, she said.