HNB’s breach of privacy going from bad to worse; CB’s pathetic response

The Central Bank of Sri Lanka is still coming to terms with what happened and is happening at Hatton National Bank. The bank must surely know confidentiality is a cornerstone of the bank-customer relationship. 

The Code of Banking Practice says banks “have a strict duty to protect the confidentiality of all our customers’ and former customers’ affairs”. This is known as a bank’s duty of confidence. Banks also have obligations under the Banking Act about personal information as to:

nhow information is collected and stored

nthe rights of people to access and correct information about themselves

nthe disclosure of personal information.

The Central Bank needs to handle complaints about a bank breaching its duty of confidence and allegations of a breach of privacy swiftly and decisively. But so far the Central Bank had only issued a mixed up and messed up statement to the public that offers no comfort to the customers. 

The bank’s duty of confidence applies to all types of bank customers, including business customers, and to all customer information held by a bank. For the Benefit of the Central Bank that is happily or ignorantly ignoring their fiduciary duty, a bank can disclose confidential information only;                                                                    

1.  When a bank is compelled by law to disclose information

This applies when a bank officer must give evidence about a customer’s affairs in court. A bank may also be legally required to provide specific information about a customer.

2.  When a bank has a public duty to disclose the information

This applies when there is a danger to the state or when the wider public needs protection against crime.

3.  When a bank has to disclose information to protect its interests

This applies when a bank takes legal action against a customer, or defends an action from a customer. 

4. When a customer agrees to information disclosure

It is acceptable for a bank to disclose customer information if the customer agrees. 

HNB has disclosed account information to the entirety of Sri Lanka by creating new ground in the history of banking in this country. Therefore what must the Central Bank do when a bank shares information it shouldn’t?

If a bank shares customer information it shouldn’t have, even accidentally, it has breached its duty of confidence. Firstly the Central Bank must establish that a breach has occurred, and thereafter assess whether customers have suffered a direct financial loss as a result and also look at whether the customer has suffered distress, embarrassment or inconvenience. If a customer has suffered direct financial loss, they should be awarded compensation for that. If the customer has suffered distress, embarrassment or inconvenience, they need to look at the impact of this on the customers. 

Many customers who have experienced embarrassment or inconvenience due to this breach are now shocked with the response of the bank. They are being pushed from pillar post by different officers to other officers giving conflicting messages and direction, one says new accounts have been issued, another says it is a choice. 

The bank’s lack of professionalism and experience is very badly showing and could face substantial claims. The Central Bank’s poor supervision in the affairs of banks is amply highlighted and they are attempting to hide it because they do not wish to get exposed. The bank’s inability to act demonstrates is weak regulatory leadership, this is clearly demonstrated in this saga.

The Central Bank has a duty obligation to protect the public and the depositors, because they are paid by the public. Sadly, if we had a Governor in the type of A.S. Jayawardana or Dr. Neville Karunathilake, good career Central Bankers, there would have been hell to pay and decisive action would have been taken by now. Instead, the current Central Bank is allowing it to free fall and allowing the bank to get away.

A HNB Priority Customer