30 Understanding Data Privacy in the Financial Services World

TCS BaNCS Research Journal

UNDERSTANDING DATA
PRIVACY IN THE FINANCIAL
SERVICES WORLD
“WE SHOULDN’T ASK OUR In the wake of recent high profile providers. The customer on-
CUSTOMERS TO MAKE A TRADE- data breaches worldwide, the data boarding process in a bank entails
OFF BETWEEN PRIVACY AND privacy debate has assumed greater capturing personally identifiable
HTTPS://GOO.GL/MGNYPT

significance and assumed center- information, and this can range from
SECURITY. WE NEED TO OFFER
stage in the regulatory world; and, sharing non-financial data such
THEM THE BEST OF BOTH. more so in the financial services as names, addresses, e-mail ids,
ULTIMATELY, PROTECTING industry given the vast amounts of contact and social security numbers
SOMEONE ELSE’S DATA personal data processed by banks/ to financial data in the form of
PROTECTS ALL OF US.” financial services organizations savings, loans accounts and debit/
- TIM COOK, CEO, APPLE and their third party IT solution credit card numbers.
 Understanding Data Privacy in the Financial Services World 31

TCS BaNCS Research Journal

GOING FORWARD,
ORGANIZATIONS WILL
REQUIRE STRONGER
GROUNDS TO PROCESS
SENSITIVE PERSONAL
DATA THAN REQUIRED
WITH “REGULAR”
PERSONAL DATA.

From a regulatory compliance religious or philosophical beliefs, regulations can help organizations
perspective, it is also important to trade-union membership; or data avoid the costs associated with
distinguish between personal and concerning health or sex life and various data breaches.
sensitive personal data. Personal sexual orientation; and genetic data
data relates to information about or biometric data. Going forward, There are also huge financial
organizations will require stronger penalties envisaged by regulators for
identified or an identifiable
grounds to process sensitive privacy infringements, and serious
natural person (“data subject”)
personal data than required with focus is required to implement and
with particular reference to
“regular” personal data. review data governance across an
an identifiers, such as names,
organization, its operations and
identification numbers, location
Cost Implications of Non information systems.
data, and online identifiers, or to
Compliance
one or more factors specific to the In addition to financial penalties,
physical, physiological, genetic, It is also important to understand the industry also faces a significant
mental, economic, cultural or the costs associated with the reputational risk to the business
social identity of that person. This data breaches resulting from in the event of any personal data
also includes financial privacy non-compliance to data privacy breach.
that refers to the maintenance regulations. Average costs
HTTPS://GOO.GL/MGNYPT

of confidentiality of customer Emerging Trends in Data Privacy in

associated with each breach the Face of Evolving Threats
information about transactions and such as related to its detection,
finances by financial institutions. response plans, notifications et As seen in the preceding section,
Sensitive personal data, on the al have been rising over the last the banking industry is one of
other hand, refers to personal few years. Implementing a robust the primary data breach targets
information that reveals racial or data compliance framework that due to the perceived value of the
ethnic origin, political opinions, enables adherence to data privacy underlying data. To capitalize on
32 Understanding Data Privacy in the Financial Services World

emerging growth oppurtunities,

TCS BaNCS Research Journal

banks need to be flexible in sharing

customer data, and it is therefore
Data breach evolution Regulatory evolution Technology adoption
critical that they achieve a balance • Increasing threat of • Increased regulatory • Focus on simplifying
between how flexible data sharing external malware focus. data protection and
programs. • • Harmonization of data controlling costs
can be while also maintaining its Growing data protection standards • Increasing use of
privacy. Recently, the “BCG Global breach events across geographies identity and access
due to malicious • Outsourcing management solutions
Consumer Sentiment Survey” ‘insiders’ destinations adopting • Using smartphones for
findings concluded that “ credit card • Breaches due to privacy laws cyber security (e.g.,
and financial information’ are the unintentional user Alerts, OTP, etc)
misakes.
most private types of data, globally.

Globally, there is a paradigm shift

in the way the banking is being
conducted. The ‘brick & mortar’
type of banking business is being
dispensed with through the rapid harshness, which makes cross- lines, focusing on the rights
adoption of digital technology. border data transfers burdensome. of data subjects and enhanced
Increasingly, banks are moving from While regulations are being scrutiny of data handlers. To give
an ownership model to a cloud adopted by different countries, the a sense of the direction that new
infrastructure. In the channels degree of intensity varies (i.e., from data privacy regulations will take,
arena, the initiation processes are the most stringent to the least or some of the key requirements as
being regulated directly by the sometimes, no regulations at all). envisaged under the EU’s Genral
customer (e.g., Internet banking, Data Protection Regulation (GDPR)
In this regard, it is pertinent to are summarized in chart 1.
Cards Platforms, Point of Sale
make a mention of the European
Terminals, etc.) with appropriate
Union’s (EU) Global Data Protection
security features. There is a
Regulation, commonly known as
visible transition in the banking
GDPR, which was finalized after
environment, with the banks
a series of amendments and
(including local cooperative banks)
will be effective from May 25,
using their front offices for sales
2018, thereby replacing the old
promotion, cross selling, upselling
Data Protection Act and other
and customer service.
national data protection laws. The
There are three emerging trends regulation, which aims to provide
in data privacy that are being a legal framework for protection
witnessed in the wake of data of personal and sensitive data to
breaches, i.e., data breach evolution, all natural people based in the EU,
regulatory focus and technology. irrespective of their citizenship
Evolving data breach threats are and where the data is processed,
forcing sweeping regulatory changes. will impact all industries that rely OFTENTIMES, THERE IS A
With the help of technology, banks heavily on the usage of natural, SIGNIFICANT VARIATION
are developing and implementing people related data.
BETWEEN DATA
operational and procedural changes New Requirements in the Data
in order to comply. Privacy Regime PRIVACY REGULATION
HTTPS://GOO.GL/MGNYPT

AND ENFORCEMENT
When it comes to data privacy The essence of evolving privacy
regulation, there rarely is a laws is on the protection and HARSHNESS, WHICH
universal law that is applicable to maintenance of a customer’s MAKES CROSS-BORDER
all. Oftentimes, there is a significant personal information. It is fair to
variation between data privacy assume that privacy laws in other DATA TRANSFERS
regulation and enforcement regions will also be on similar BURDENSOME.
 Understanding Data Privacy in the Financial Services World 33

TCS BaNCS Research Journal

Chart 1

Chapter Category Requirements

1 General • This regulation lays down rules relating to the protection of natural people with
Provisions regard to the processing of personal data and rules relating to the free movement
of personal data.
• GDPR applies to data processing of EU citizens in their country of residence or a
foreign country.
• Data exchange is allowed only if a country or counterparty is compliant with GDPR.
2. Principles • Explicit consent from customers to process their data.
• Demonstrate content from customer data both initially and after any correction/
deletion in a structured format, ensuring that there is an audit trail.
• Special protection for the personal data of children.
• Data subjects must be informed about the right to withdraw their consent at any
time (consent must be as easy to withdraw as to give).
• Audit log for future references by stake holder/ enquiry/ delivery of data.
• Data encryption or “pseudonymization” to prevent data breaches.
3. Rights of the • Electronic formats and the process of capturing customer consent.
Data Subject • Collection of customer data in standard questionnaires to align customer data as
well agreements for further processing, e.g., KYC, fraud, marketing. In any case, data
is required for KYC, fraud to prevent customer loss and compliance.
• Automated and secure Information of the data subject in an electronic or paper
format
• Support customer requests for information, correction, and erasure within a month.
• Notification about subject information in case of requests for information,
correction, deletion in a structured form, allowing the channel to process this
automated information.
• Audit trail of notifications for data subjects.
4. Obligations of • Data mapping is required to be able to determine compliance with GDPR.
Controller & • Gap analysis based on data mapping with GDPR level of compliance.
Processor
• Governance and policies for data protection.
• Data protection by design and by default.
• Prevention of attacks via encryption, “anonymization”, “pseudonymization”,
controlled access & data minimization.
• Accountability, by documenting process flows, privacy controls and decisions made
for data protection.
• Ensure security of processing.
HTTPS://GOO.GL/MGNYPT

• Notification of data breaches.

5. Transfer of • Standardized reports for use by customer.
personal data • Restrict transfers of data outside EU with appropriate system validation.
to third-party
• Audit logs of data transfer for traceability.
countries or
international • Secure transfer mechanism to prevent data loss and its falsification.
organizations
34 Understanding Data Privacy in the Financial Services World
TCS BaNCS Research Journal

Data Privacy Framework of information systems, Designing Data Security Laws and
remediate and roll out upgraded Governance
Compliance to data privacy information security systems
regulations will require a structured Financial services organizations
approach. Organizations will need to To facilitate the above, the program will have to overcome a number of
will need to assess current policies challenges in implementing data
• Define and roll out a robust and frameworks, processes protection practices.
governance model to implement and IT systems. This will need
data privacy programs to be followed by design and Firstly, the key to successful
development of new policies and implementation of any data privacy
• Review, design and implement a
processes and, lastly, implemented regulation lies in winning trust
target operating model
and monitored through a well- of customers through a well-
• Review current capabilities designed program. defined data security architecture
De
s

Governance
es

fin
s
As

Data
Privacy

Operations Information
HTTPS://GOO.GL/MGNYPT

Systems

Implement

Figure 1:
A Data Privacy Framework
 Understanding Data Privacy in the Financial Services World 35

TCS BaNCS Research Journal

Chart 2

Areas Data Privacy Activities

Governance • Define and implement a data privacy program.

• Re-define data governance policy framework, data principles and integrate them within
existing functions.
• Re-define reporting needs for requisite senior management focus.
• Appoint data protection officers.
• Design and develop privacy impact assessments.
• Review and update partner Agreements for data privacy clauses.
• Define and review supplier relationships.
• Create awareness across functions within the enterprise.
• Develop and roll out a role-based induction program.
• Conduct privacy assessments regularly and as and when new products /processess are
launced.
Operations • Define templates for data privacy notices.
• Define processess for recording consent, withdrawal of consent, correction of stored
data, data erasure and portability.
• Define a policy for retention and disposal of data.
• Integrate security solutions with regular operations.
• Establish data audit trails.
• Maintain system activity report logs, templates, response records of data subjects.
• Maintain data sharing logs, policies, protocols and disclosures.
Information Systems • Assess IT systems’ data privacy architectures for new requirements such as consent
management, data privacy notices, data erasure, portability and breach notifciations.
• Remediate and re-design applications to enable prevention controlled access and data
minimization.
• Define access control points.
• Implement automated compliance controls.
• Maintain incident logs.
• Conduct regular compliance, audit and vulnerability tests.

without compromising on the significance in deciding the data data protection laws globally.
advantages and benefits of data security design at various levels The EU has taken the lead in
access and networking. This will across the chain. Organizations will repealing older versions, which
pose a significant challenge in also have to balance the needs of will be effective from May 2018,
implementing data protection shared data access with that of data and other regions and countries
HTTPS://GOO.GL/MGNYPT

by design. Who needs to see the security. are expected to follow suit. Given
data and to what extent, and who the multinational nature of most
does not need to when carrying Secondly, there have been a businesses, especially in the
out regular tasks will play a key number of data breach incidents in banking sector, the challenge will
role in designing these laws. the recent past where customers’ also lie in stating a multitude of
Encryption, “anonymization” and data has been stolen, and this has such laws in various forms and
“pseudonymization” will assume added to the urgency in revising understanding the nuances for each
36 Understanding Data Privacy in the Financial Services World
TCS BaNCS Research Journal

region. Data protection in the EU when implemented will only be

could be quite different from laws successful if people are made
in the USA. adequately aware and educated
about its importance.
Thirdly, in an environment where
outsourcing is the norm, fixing In Conclusion…
Yogesh Sharma
responsibility for liability in
As the dependency of banks on Product Specialist
circumstances where personal TCS Financial Solutions (TCS BaNCS)
technology is increasing, banks are
data has been disclosed to various
facing exponentially increasing
recipients, including third-
privacy and security risks to their
party countries or international
valuable assets. With this, the
organizations, will prove to be a
cyber-crimes related to banks have
challenge. The legal agreements
also increased manifold even as
between data controllers and data
security mechanisms employed by
processors will have to review and
banks are no longer optimum. A
reflect any changes as per the new
robust data privacy framework is
data protection regimes.
required to provide a safe banking
Finally, lack of awareness among environment to users. As customers
people handling data at various become wary of the data security
levels is another challenge. risks, this could also be seen as a key
People need to understand the differentiator for banks as they look
importance of data security and for growth opportunities. The focus
on data privacy will definitely be a
HTTPS://GOO.GL/MGNYPT

own it at all levels. Any data

protection compliance program key factor in winning customer trust.

Nageshwaran R
Product Specialist
TCS Financial Solutions (TCS BaNCS)