It is an implied term of the contract between customers and their banks and building societies that these firms will keep their customers’ information confidential. This confidentiality is not just confined to account transactions – it extends to all the information that the bank has about the customer.
But from time to time, mistakes happen and – for whatever reason – banks end up releasing information that they should have kept secret. Sometimes, the resulting breach of confidentiality is little more than technical (in other words, nothing really flows from it), but occasionally it can have major consequences.
This article explains our general approach to complaints involving a bank’s breach of a customer’s confidentiality, and illustrates how we look to resolve them.
First of all, a banker’s duty of confidentiality is not absolute. The 1924 case of Tournier v National Provincial and Union Bank of England sets out four areas where a bank can legally disclose information about its customer. These principles still hold good today and are:
If we decide that a bank disclosed information under one or more of these circumstances, then we are unlikely to interfere. But most of the complaints we receive involve situations where the bank should not have disclosed information – because none of the Tournier principles applied.
If a bank discloses information about a customer in any circumstances other than those described above, then it has acted wrongly and should, as a general rule, be held liable for the reasonably foreseeable consequences of its action. Some banks seem to think it should make a difference if they disclosed the information by accident – but it does not. If a bank’s carelessness leads to a breach of confidentiality, that does not diminish the fact that the bank acted in breach of a fundamental duty it owed to its customer.
It is relatively rare for us to come across a case where information was disclosed deliberately. Mostly, it happens by accident.
Customers rightly expect high standards from their banks and building societies. So if they discover that their private information has been wrongly divulged to someone else, they can become very unhappy – even if the disclosure has resulted in little more than minor frustration or embarrassment.
But even a minor mistake by a bank can lead to significant problems – particularly if the customer is running a business. We have seen cases where simple clerical errors have led to serious business losses.
The important point here is for the bank to look at the consequences of its actions for the customer – and to distinguish clearly between "loss" and "distress and inconvenience". All too often we find that banks fail to do this properly. Even where they accept they have done something wrong, they often try to settle the matter by offering the customer some money without first assessing either:
Both banks and customers need to take a realistic look at any real losses resulting from the bank’s breach of confidentiality. The bank should generally be liable for losses that it could reasonably have foreseen when it disclosed the information.
In our experience, banks regularly fail to pay proper attention to the true costs that customers can incur as a direct result of the breach of confidentiality. The key, therefore, is for both parties to analyse and understand the true effects of the bank’s actions.
Occasionally, customers who have experienced minimal or no financial loss feel that their "good name" has been "irreparably damaged" by what has happened. They may go on to claim large sums of money as compensation, perhaps quoting high-profile court cases. However, we take a more balanced view.
In exceptional circumstances we might award compensation of some hundreds of pounds for significant breaches of confidentiality. But any compensation we award is generally far more modest. Minor mistakes will warrant little more than a nominal payment, if any.
When assessing compensation for distress and inconvenience we follow the approach outlined in our technical briefing note awards for non-financial loss.
When Mrs K moved house she wrote to her bank giving details of her new address. The following month, the bank sent her account statement to her new next-door neighbour because it had misread the handwriting on her letter. After opening the envelope by mistake, the neighbour called round to Mrs K’s house right away to apologise and give her the statement.
Mrs K then complained to her bank, saying that she had been "acutely embarrassed" in front of her new neighbour – particularly since the statement had shown that she was overdrawn (after having to pay all the costs of moving house).
Mrs K demanded an apology from the bank’s chairman, together with "a written assurance" that such a mistake would never happen again, and compensation of £5,000, which she said was to help her get over the "trauma" of having to face her new neighbour every day now that the neighbour knew her "financial secrets".
The bank offered Mrs K £50. Rejecting this as an "absolute insult", Mrs K came to us.
By the time the complaint was referred to us the bank had been in touch with the neighbour, who said she had not looked at the statement in any detail, and certainly couldn’t remember what it said. In fact, she said she felt embarrassed by having mistakenly opened a letter that had not been addressed to her.
We decided that Mrs K had not suffered any financial loss as a result of the incident, and that she was very much over-playing her claim. We felt that the bank’s offer had been sufficient and after we explained this to her, we heard nothing more.
Miss J lived with her partner, Mr C, who had occasionally been violent towards her throughout their relationship. After he lost his job and started drinking heavily, the violence became so much more frequent and more damaging that Miss J felt she was in serious danger.
One night when Mr C was out, Miss J left home and moved into a rented flat.
First thing the following morning, she went to her bank to change the address on her accounts. She explained why she had moved, and said that under no circumstances should the bank tell Mr C where she now lived.
The bank changed the address on all of Miss J’s accounts but, by accident, it also changed the address on the joint account she held with Mr C. This was because the bank had "linked" the accounts for the members of the household on its computer system (which is a common practice these days), but had unfortunately not removed the link before making the address change.
A few weeks later, Mr C went in to the bank to ask for a loan. While the member of staff was getting his details up on the computer screen, Mr C saw that the joint account had a different address. Realising that that was probably where Miss J had moved to, Mr C went round there, broke down the front door, and severely assaulted Miss J.
Miss J was in hospital for several days – she was very badly bruised and had suffered some internal injuries.
Some weeks later, after Miss J had recovered sufficiently, she complained to the bank about what it had done. It wouldn’t at first accept that it had done anything wrong. But it soon became clear that the facts were not in dispute – it had been responsible for letting Mr C find out Miss J’s new address. It apologised, and offered her £300. But Miss J did not think this was adequate compensation, so she came to us.
When Miss J brought her complaint to us she sent us some photos taken when she was in hospital. These showed some of the injuries caused by Mr C and we thought that her suffering merited a payment far in excess of £300.
Miss J had not asked for any particular amount – she had simply said that she wanted more than £300 but would leave it to us to come up with a suitable figure. We suggested to the bank that it should consider increasing its offer substantially – say ten-fold. It did this and Miss J was happy to accept the increased payment. She also said she would not now move her accounts to another bank, as she had initially threatened to do.
After Mrs B’s husband started to become violent towards her and their six-year old daughter, she realised she needed to get away. She made careful arrangements to move with her daughter to a flat in a town about 100 miles away.
Mrs B told the bank what was happening, and asked it to keep her new address confidential. But the bank let slip the new address – this time by sending a copy of the "confirmation of new address" form to Mrs B at her old address. Mrs B found out what had happened when her husband forwarded the bank’s letter on to her.
As a result of the bank’s mistake, Mrs B was once again in fear for her own safety and that of her daughter. She made hasty arrangements for another move – to a different town, further away. Luckily, her husband did not find out her new address – so neither she nor her daughter suffered further physical harm. However, Mrs B sent the bank a claim for all the additional costs she had incurred in uprooting herself and her daughter once again.
The bank accepted its fault in wrongly letting Mr B know her new address. However, it did not accept liability for the losses Mrs B had claimed for. Instead, it simply offered her £500, to reflect the inconvenience she had been caused. Mrs B then came to us.
We did not think the bank’s offer was good enough. We felt that, as a result of the bank’s error, Mrs B had incurred costs that were reasonably foreseeable and that the bank should therefore reimburse.
This all came to £1,000. So in addition to the "inconvenience" offer of £500 (which we thought was about right) we suggested that the bank should settle the complaint by paying a total of £1,500, which it agreed to do.
The business that Mr L ran was in financial trouble. In June 2003, he took out a £20,000 personal loan from the bank to try to shore things up. Mr L told the bank that he wanted all the paperwork for the loan to be sent to his business address, as he didn’t want his wife to know what was happening. The bank agreed.
Unfortunately, the business did not improve over the next year, and Mr L had difficulty in keeping the loan repayments up to date. Eventually the bank transferred the loan to its debt recovery department, where a new manager decided to phone Mr L at home one afternoon to talk about repaying the debt. Mr L was out at work but his wife answered the phone. The manager left a message with Mrs L, asking her husband to "get in touch with the bank as soon as possible about the £20,000 loan that is in default".
When Mr L returned home he had to explain everything to his wife. He later said that all of his wife’s trust in him ‘after 40 years of happy marriage, was wiped out in one go’. Mr L complained to the bank about what it had done, and claimed £20,000 compensation – enough to pay off the loan and leave a little left over.
The bank accepted, right from the start, that it had acted wrongly. Initially it offered Mr L £1,000. When Mr L turned this down it quickly increased its offer to £2,000. But Mr L felt this was still not enough and he came to us.
We thought that the offer of £2,000 was not only fair but rather generous, given the overall circumstances. We encouraged Mr L to accept it and he eventually did so, but not before telling us that we were wrong to have "undervalued" his marriage "such that each of the 40 happy years was worth only £50".
Mr A ran a small but growing business from premises he leased from P Ltd. He asked the bank to address bank statements for his business account in the following way:
Mr A, trading as "A Products"
c/o P Ltd
The bank agreed to do this, but on one occasion it made a mistake and sent one of the statements to:
The statement was delivered to, and opened by, P Ltd – who used the same bank as Mr A. P Ltd saw that Mr A had a large overdraft. Since Mr A was a month behind with his rent, this information caused P Ltd to send in the bailiffs. The seizure of Mr A’s stock, and the knock-on effect in a small business community, caused Mr A’s business to fail.
Mr A had only asked for the bank statement because he knew he was behind with the rent and wanted to check on his account to see how best he could bring his rent payments up to date. The overdraft had come about because his business had been growing very quickly and he was waiting for a large number of invoices to be paid.
When the bank declined any responsibility for the consequences of its mistake, Mr A come to us.
In our view, P Ltd’s action was precipitate – and it was caused solely by the bank’s breach of confidentiality towards Mr A. We recognised that it was a small, and accidental, clerical slip by the bank. But we also thought that the possible consequences of its action were reasonably foreseeable and had been very damaging. We therefore required the bank to pay Mr A compensation of just over £40,000.
Mr N was barely on speaking terms with his sister, Mrs G, because of their differing views as to how they should look after their elderly widowed mother. Mr N wanted his mother to move to an expensive nursing home, while Mrs G wanted to leave their mother at home and to arrange for a neighbour to call in each day to check on things.
Eventually, Mr N decided to go ahead and move his mother to the nursing home. Mrs G refused to pay when he asked her to contribute half of the costs, so Mr N and his wife arranged to go to a solicitor to try to force her hand.
Mrs G had a savings account at the branch of the building society where Mrs N worked. Mrs N decided to check how much money Mrs G had in this account. She then told the solicitor – who used the information in correspondence. When Mrs G discovered what the solicitor knew, she challenged her sister-in-law – who admitted how she had obtained the information.
Miss G complained to the building society about what her sister-in-law had done. However, the society said this was a private family matter. Mrs G then referred the complaint to us.
After our intervention, the society accepted that Mrs N’s actions had breached Mrs G’s confidentiality. Mrs N had also broken her contract of employment.
The society decided to offer Mrs G £500. In response, she asked for £1,000. We were eventually able to mediate a settlement at £800.
ombudsman news gives general information on the position at the date of publication. It is not a definitive statement of the law, our approach or our procedure.
The illustrative case studies are based broadly on real-life cases, but are not precedents. Individual cases are decided on their own facts.