A joint statement from the Financial Conduct Authority and the Information Commissioner’s Office has sought to remove any lingering doubt over whether data protection rules prevent firms from collecting, recording and sharing vulnerability data where it is needed to support customers.
The statement, published last week, says UK GDPR, the Data Protection Act 2018 and related privacy rules do not stop firms from delivering good outcomes for consumers in vulnerable circumstances, provided they comply with data protection requirements.
For firms across financial services, the message is a pointed one. The regulators say businesses should identify indicators of vulnerability, keep relevant records and review customer needs over the life of a product, while also using and sharing personal information lawfully where this is appropriate and necessary.
The joint intervention also underlines the importance of passing relevant information through the distribution chain, with the FCA and ICO calling for firms to share vulnerability-related data where needed so customers receive suitable support throughout the product lifecycle.
MorganAsh, which specialises in customer vulnerability and Consumer Duty, said the clarification should help remove a longstanding obstacle for firms that have been wary of falling foul of data protection law.
Andrew Gething, managing director of MorganAsh, said: “The fear of non-compliance with GDPR has stalled progress on Consumer Duty and its requirements for customer vulnerability management.
“This joint guidance from the FCA and the ICO not only reiterates that firms can hold and process vulnerability data in line with data protection laws, but they are actively encouraged to share it within the distribution chain to improve outcomes.
“To do this, firms need good data that can be transferred and in a structured format. Holding vulnerability data that is subjective, inconsistent and found in free text boxes in CRMs will make this far harder to achieve.
“Robust IT systems will enable firms to not only gather the necessary information in an objective and consistent way, but ensure its up to date, secure and fully auditable, ready for reporting to the regulator or for any future subject access requests.
“We are pleased to be working closely with the CII, contributing to their data sharing taskforce and supporting the further development of practical guidance in this area.”
The FCA and ICO statement focuses on three areas in particular: supporting consumers in vulnerable circumstances, sharing data across distribution chains and monitoring outcomes. It is designed to help firms apply Consumer Duty expectations while maintaining confidence in the lawful and responsible use of personal information.
MorganAsh said this strengthens principles already set out by the regulators in earlier guidance and communications stretching back to 2015. The business is working with the Chartered Insurance Institute through its data sharing taskforce to help develop standardised formats for sharing vulnerability data.
The firm argues that the latest statement increases pressure on advisers, providers and distributors to move away from informal or fragmented record-keeping and towards systems that can capture vulnerability information consistently, securely and in a form that can be transferred when required.
That is likely to resonate across the market as firms continue to refine their Consumer Duty frameworks and prepare for greater scrutiny of how they identify, monitor and support customers whose circumstances leave them more susceptible to harm.
