Should I expect a financial adviser to keep my finances confidential?

eskbanker

Deleted_User wrote: »

You won't get compensation from the data regulator - the IFA will and should be fined (of between 2 and 4% of turnover).

This is a myth - ICO can fine companies up to 4% of turnover but it's a sliding scale effectively starting at zero for relatively minor breaches such as this.

To put it into perspective, the high-profile fine recently levied on British Airways, for a massive and sustained breach involving the personal data of half a million customers, was 'only' 1.5% of their turnover....

SonOf

Deleted_User wrote: »

Have you given explicit consent for your records being divulged to your husband. (implicit is not good enough)
You won't get compensation from the data regulator - the IFA will and should be fined (of between 2 and 4% of turnover). If you have informed the IFA of this breach - the IFA themselves should notify the regulator that there has been a breach.

This is not a fine worthy breach. It is very minor.

It is a breakdown in communication that is easily resolved.

[Deleted User]

SonOf wrote: »

This is not a finable breach. It is very minor.

It is a breakdown in communication that is easily resolved.

It’s still a breach, and considering it involves financial information it’s more than minor
The fact they are married is irrelevant

danm

this is tricky for the IFA but is a clear breach of GDPR.


There is no 'breakdown of communication' arguments here. The OP was the client. The IFA should have advised the OP based on the information she was willing to disclose.


If the IFA did not think the OP was disclosing all circumstances maybe he could have raised it or chose not to take the business if the separation of arrangement put him in a difficult spot professionally.


If the IFA disclosed or used any of the OPs information when in communication with spouse then there has been a breach of GDPR.
Also, if the IFA has used any information of the spouse when advising the OP, there has also been a breach of the spouses GDPR rights.


This is pretty black and white. The IFA should know how to process personal information and based on everything I have read they have not considered how to arrange their business in order to comply - Is it intentional, likely not.


be interested (not really) to see what their privacy notice looks like.

eskbanker

Deleted_User wrote: »

It’s still a breach, and considering it involves financial information it’s more than minor
The fact they are married is irrelevant

The fact that they are married is relevant, in the sense that the breach is much less significant than if, say, personal financial details were divulged to a complete stranger. Nobody's denying it's still a breach (based on what OP has posted) but there is obviously a scale of severity with such incidents and this one really is at the lower end....

danm

eskbanker wrote: »

The fact that they are married is relevant, in the sense that the breach is much less significant than if, say, personal financial details were divulged to a complete stranger. Nobody's denying it's still a breach (based on what OP has posted) but there is obviously a scale of severity with such incidents and this one really is at the lower end....

can't agree here - What if someone in a similar situation wanted to liquidate assets to run away from an abusive spouse - how about if they had a windfall they did not want the spouse to know about - many scenarios that could have significant and serous consequences (life and death)


very different to BA losing 100,000 customers addresses - but significant nonetheless

eskbanker

danm wrote: »

can't agree here - What if someone in a similar situation wanted to liquidate assets to run away from an abusive spouse - how about if they had a windfall they did not want the spouse to know about - many scenarios that could have significant and serous consequences (life and death)


very different to BA losing 100,000 customers addresses - but significant nonetheless

My point was a more general one, rather than trying to cater for all sorts of hypothetical extreme examples that could be conjured up.

I'm sure if there were such circumstances then OP would have referred to them in the thread, but, yes, factors like that could indeed influence the ICO if applicable....

SonOf

can't agree here - What if someone in a similar situation wanted to liquidate assets to run away from an abusive spouse - how about if they had a windfall they did not want the spouse to know about - many scenarios that could have significant and serous consequences (life and death)

Wouldn't you expect the individual to state to the adviser that they dont want their spouse to know?

However, you dont get redress on hypothetical scenarios.

You just have to look at redress on DP breaches to realise how insignificant this will be viewed as.

danm

SonOf wrote: »

Wouldn't you expect the individual to state to the adviser that they dont want their spouse to know?

However, you dont get redress on hypothetical scenarios.

You just have to look at redress on DP breaches to realise how insignificant this will be viewed as.

its less about the individual and what they say and more about the advisor and what they are obligated to do as the data controller. The adviser has an obligation. If he wanted to share it he needs explicit permission.


agree that redress unlikely to be material for the OP...as there has been limited harm - however, that does not excuse the breach and I am sure if the ico looked under the bonnet of the firm there would be other similar examples (these things rarely happen in isolation - especially when there is lack of awareness)

SonOf

its less about the individual and what they say and more about the advisor and what they are obligated to do as the data controller. The adviser has an obligation. If he wanted to share it he needs explicit permission.

Permission that requires no signatures anywhere and there is a reasonable expectation that a couple receives joint financial advice unless instructed otherwise.

The adviser could easily say that they deal with the husband and wife giving financial advice which covers joint scenarios and at no point was there any instruction to keep the affairs from each other.

I am partly playing devil's advocate, here but we are only seeing one side of the story and the OP has a) confirmed that they never told the adviser at the start and b) never told the adviser on the previous occasion they say there was a breach. So, the adviser has a fair bit of mitigation. Hence why any report is not going to be classed as a major breach (in addition to the other reasons previously covered).

and I am sure if the ico looked under the bonnet of the firm there would be other similar examples (these things rarely happen in isolation - especially when there is lack of awareness)

Probably not as the vast majority of people work jointly. Even those with sole bank accounts will usually sit together in meetings and discussions. This particular scenario of complete secrecy is uncommon. It certainly happens but I suspect most typical-sized adviser firms probably only have one or two like it.

Its been an interesting thread nonetheless.