Bank customer profiles how long is data held for

steven141

Out of curiosity more than anything, does anyone know how long banks hold customer information for? I know that there is a 6 year limit for certain things but say you close an account down and you join after 6 years, will they still have a profile for you on file or does it get deleted?

eskbanker

It varies, rather than being prescribed - banks will each have their own data retention policies.

born_again

Depends. Some it will be deleted. Others are kept, as details are on system.

Futuristic

All financial institutions need to hold the data for at least 6 years, it's likely most of them keep some form of your details/archive forever. 

I guess you can apply to see what they hold using GDPR/SAR after that time. 

DullGreyGuy

steven141 said:

Out of curiosity more than anything, does anyone know how long banks hold customer information for? I know that there is a 6 year limit for certain things but say you close an account down and you join after 6 years, will they still have a profile for you on file or does it get deleted?

There is no 6 year limit

GDPR requires them to have a legitimate business need for storing personally identifiable information. Given you have up to 6 years to sue a company for breach of contract then the standard baseline is that most data should be kept for 6-7 years after an account is closed to cover the need to be able to defend a claim. Some may decide there is legitimate needs beyond 6 years 

artyboy

Once LBG decides they don't want you, they say that if you ever try to open an account with them, they will immediately close it. That suggests they consider it appropriate to retain forever at least a basic record of you for identification purposes.

Ballard

eskbanker said:

It varies, rather than being prescribed - banks will each have their own data retention policies.

This would be a good starting point and this policy should be available on their website, I believe. 

blue.peter

When I closed my First Direct accounts, I was explicitly told that they'd retain my data "in case you ever decide to come back to us". So the clear implication is that they (and, presumably, the rest of HSBC) will keep customer data indefinitely.

Nasqueron

artyboy said:

Once LBG decides they don't want you, they say that if you ever try to open an account with them, they will immediately close it. That suggests they consider it appropriate to retain forever at least a basic record of you for identification purposes.

Yes banks, and any private business, is allowed to hold data as long as they deem necessary. 6 years is considered the minimum and baseline for the reasons above but you could see with the whole PPI problem that some had records going back to the 1990s, not necessarily even still customers.

An internal blacklist based on customer being undesirable is perfectly fine for any business to hold e.g. for switch bonus history, failure to repay debts etc

DullGreyGuy

blue.peter said:

When I closed my First Direct accounts, I was explicitly told that they'd retain my data "in case you ever decide to come back to us". So the clear implication is that they (and, presumably, the rest of HSBC) will keep customer data indefinitely.

They do hold some data at least as was refused transfer bonus to FD as allegedly held an ISA with them over a decade earlier. 

Nasqueron said:

artyboy said:

Once LBG decides they don't want you, they say that if you ever try to open an account with them, they will immediately close it. That suggests they consider it appropriate to retain forever at least a basic record of you for identification purposes.

Yes banks, and any private business, is allowed to hold data as long as they deem necessary. 

Not strictly true, they must have a legitimate business need and the ICO have fined firms for holding onto data "just because" and not having a need. 

Its not too hard to have a legimate need, like being able to manage brand new customer only offers, but still that'd be limited to data to identify the person, if you were also holding medical conditions for the purposes of the free travel insurance it would be hard to justifying retaining knowledge that a customer is HIV positive for the purposes of managing new customer promotions. 

Nasqueron

DullGreyGuy said:

blue.peter said:

When I closed my First Direct accounts, I was explicitly told that they'd retain my data "in case you ever decide to come back to us". So the clear implication is that they (and, presumably, the rest of HSBC) will keep customer data indefinitely.

They do hold some data at least as was refused transfer bonus to FD as allegedly held an ISA with them over a decade earlier. 

Nasqueron said:

artyboy said:

Once LBG decides they don't want you, they say that if you ever try to open an account with them, they will immediately close it. That suggests they consider it appropriate to retain forever at least a basic record of you for identification purposes.

Yes banks, and any private business, is allowed to hold data as long as they deem necessary. 

Not strictly true, they must have a legitimate business need and the ICO have fined firms for holding onto data "just because" and not having a need. 

Its not too hard to have a legimate need, like being able to manage brand new customer only offers, but still that'd be limited to data to identify the person, if you were also holding medical conditions for the purposes of the free travel insurance it would be hard to justifying retaining knowledge that a customer is HIV positive for the purposes of managing new customer promotions. 

I'm not sure why my posts have to be replied to, in order to provide a correction that simply says the same as I already did. A bank could always justify holding data for business purposes - hence what they "deem necessary". 

Per forum team advice, I am adding you to the ignore list.