Introduction

A transformation of the global privacy landscape is now occurring as a result of new regulation, legislation, rapid changes in business processes and advances in technology. These trends are interconnected, and their interconnectedness also entails greater dependence on the internet and significant evolving threats in cyber-intrusion, information theft and identity theft. For a financial institution, privacy and safekeeping requirements grow with the increasing complexity of global markets, advances in the use of new technologies, the desire to improve and procure new financial products and, most importantly, because of a fiduciary duty to maintain and assure the integrity and authenticity of corporate, customer and employee information.

There is no common global definition of information privacy across financial markets. It has different definitions with different requirements across numerous distinct legal and regulatory frameworks. A financial institution subject to the laws of the jurisdictions where it transacts business must know what these laws are and how its business processes and technology platforms function, if it is to comply. Compliance is not always possible, but risk impact needs to be assessed and managed. Privacy protocols vary by jurisdiction and by what sector governs the business. Today, information privacy in financial markets is a chequerboard of legislation and political issues coloured by cultural differences and data protection priorities.

The terms ‘data protection’ and ‘information privacy’ often cause confusion. ‘Data protection’ usually refers to the statutory rights of individuals in European Union (EU) member states to control access to their personal data; in the USA the term is often used in information technology to refer to data security. ‘Information privacy’ sometimes covers all types of information but at other times is used to refer only to personal information. Personal information is data that will identify a person in their private non-public self. In the financial sector, privacy information regulation has different definitions and scope such as personally identifiable information, non-public personal information, customer and/or consumer information and employee information, which includes a subset of sensitive personal information about, for example, health, race or religion.