Nationwide fined £980,000 for information security lapses

LONDON - The UK Financial Services Authority (FSA) has fined Nationwide building society £980,000, for failing to have effective systems and controls in place to manage its information security risks.

Following the theft of a laptop computer from a Nationwide employee's home last year, the FSA launched an investigation into the building society's information security procedures, and found them to be inadequate, potentially exposing customers to an increased risk of financial crime. More worryingly, the FSA investigation discovered Nationwide was not aware the laptop contained confidential customer information, and that the building society did not start an investigation until three weeks after the theft.

"Nationwide is the UK's largest building society and holds confidential information for more than 11 million customers," says Margaret Cole, director of enforcement at the FSA. "Nationwide's customers were entitled to rely on it to take reasonable steps to make sure their personal information was secure. Firms' internal controls are fundamental in ensuring customers' details remain as secure as they can be and, as technology evolves, they must keep their systems and controls up-to-date to prevent lapses in security. The FSA took swift enforcement action in this case to send a clear, strong message to all firms about the importance of information security."

Nationwide co-operated fully with the FSA and by agreeing to settle at an early stage, it qualified for a 30% discount, without which the fine would have been £1.4 million.