ICO withdraws advisory support in dispute between NatWest Bank and former worker over customer data

Bank's ex-employee claims she has highly sensitive details of 1,600 customers, but bank is not taking it back

The Information Commissioner's Office (ICO) has ended its advisory support in a dispute between NatWest Bank and a former employee over highly confidential data of more than 1,600 customers, which the employee says is stored at her home.

The former branch worker, who wishes to remain anonymous, told Computer Weekly that the ICO informed her this month that it was unable to proceed with the case as the Data Protection Act 1998 covered only electronic information and not paper-based information.

The regulator also confirmed that it had withdrawn its advisory support in the dispute.

The ICO, however, refused to comment why it failed to tell the ex-employee earlier that it was unable to take any action in the case.

The former employee of NatWest (earlier Royal Bank of Scotland/RBS) worked at the bank from 1998 until 2009, selling loans and mortgages to customers. In 2006, she requested her manager to allow her to work from home due to personal reasons. The request was accepted.

As part of the working arrangement, she received paper documents with customer details from her manager. The work from home setup continued until 2009, when the ex-employee realised that the HR department of the bank was not aware of her work arrangement.

She explained to the bank her concerns about the customer data stored in her home, and was asked to provide details in writing to her manager. The bank eventually terminated her contract in May 2009 for not returning all paper documents to the bank.

The woman says that she has been trying to return all documents to bank ever since she left, but both parties have so far failed to reach an agreement over a secure handover.

In 2012, the ICO found that NatWest had violated the Data Protection Act, although it did not take any action against the bank.

The woman also returned some documents to the ICO in 2012, but retained a box containing about 1,600 customer files as evidence for any legal proceedings.