Bank could face outsourcing legal action

Lloyds TSB could face legal action over its offshoring practices as a customer, along with staff union, The Lloyds TSB Union (LTU), has instigated an investigation into the financial services giant's offshoring practices.

The union claims that by taking customer data outside of the EU the bank is breaking legislation that states sensitive data can't be taken outside the European Economic Area.

The bank announced the transfer of almost 1000 jobs from its call centre operation in Newcastle to a division in Bangalore in October last year. The union has been actively campaigning against the offshoring of jobs and says if the challenge is successful, it would have wider implications for the financial services industry as a whole.

National Outsourcing Association

Trade body, the National Outsourcing Association, has said that transferring personal data (ie information relating to living individuals) is permissible on a number of grounds under the European Data Protection Regime (given full legislative effect in the UK by the Data Protection Act 1998) provided certain steps are taken.

The NAO said: "Sensitive data is a sub-category of that personal data, covering by way of example racial or ethnic origin, political opinions, religious beliefs, trade union membership or health. The first question therefore is the extent to which the data flows contemplated by the offshoring would include this type of sensitive information. If so, then offshoring does require compliance with additional steps (rather than meaning that the personal data cannot be offshored).

"The regime introduced by the DPA is designed to protect the individual. But it does affect business practice since all businesses are required to take account of the protections.

"Different countries have different interpretations of the DPA so the commission has set a standard, saying that certain criteria have to be met in how data is stored and treated. The Commission outlines which countries meet the said requirements.

"But companies doing business outside the EU can nevertheless transfer personal data to each other on a number of grounds eg using the so-called "contract clauses" route ie incorporating a commitment to comply with the regime into their contracts. This means that companies in India, for example, may comply with the regime by complying with their contracts.

"Each corporate or financial institution considering outsourcing should in any event, and as a matter of good practice, undertake analysis to identify the steps to be taken to enable the outsourcing to stand in compliance with the EU DP regime, and that includes any additional steps appropriate in respect of sensitive data. We don't suggest that any outsourcing be undertaken without that analysis, and due account being taken in the contract to ensure adequate security, that the service provider acts on the customer's instructions regarding personal data and otherwise acts to comply (and enable the customer to comply) with the EU DP regime.

"With anti offshoring sentiment running high, the LTU may be hoping to find a loophole to instigate a government protectionist stance, to stop the onslaught of offshoring practice. This is unlikely to happen - data protection law does not impose a blanket ban on exporting personal data and many companies are embracing offshoring and it is becoming an integral part of the business landscape. The LTU has to realise that offshoring does not necessarily mean disaster for the UK employment market.

"As with Amicus and Unifi, the unions are of course to be commended on checking that the protections offered under the EU DP regime to the individuals who comprise their membership are being respected, but should ensure that they are not seen to raise issues that are ultimately not substantive as this could simply raise fears and a level of emotion in their members that may not be borne out."