Protect against privacy breaches

“With increased technology to store client data, as well as clients’ personal information,” Tasson said, “most, if not all, organizations have this exposure.”

Financial advisors are especially susceptible given the sensitive nature of the client information they’re dealing with, said Warren Cooney, senior claims specialist with AXIS Reinsurance Co.

“You’re asking them for information that people, I think would agree, is the most confidential of information. If you’re a life agent, you’re asking about their health and their medical history, and you’re also asking about their financial history and their financial information,” Cooney said. “Those are incredibly confidential and important pieces of information people are increasing realizing are susceptible to theft and breaches.”

The recent case involving the Investment Industry Regulatory Organization of Canada (IIROC), in which a staff member lost a laptop containing the personal information of more than 50,000 clients of brokerage firms, underscored the potentially large scope of a privacy breach that can result from the loss of a single device, Tasson said. It also revealed the damaging impact that such a breach can have on an organization’s reputation, she added.

IIROC faces possible class action for lost data

“IIROC is facing multiple investigations, both internal and by third parties, and definitely some intense media scrutiny,” she said. “This just goes to show you that these privacy breaches happen very frequently, and to various organizations.”

This type of loss certainly occurs frequently: in 2011, 22% of Canadian businesses had reported a loss of a laptop or smartphone.

If a financial advisor experienced a similar loss of data, Tasson said the costs could be potentially very steep. The average cost of a lost laptop is nearly $50,000, she said, when factoring in the replacement of hardware and software, legal costs, the cost of notifying clients of a possible breach of their personal information, lost proprietary intellectual property, forensic investigations into the nature of the lost data, and other miscellaneous costs.

This type of loss could also jeopardize your existing client relationships, causing clients to re-evaluate whether they trust you with their personal information. “You may also be losing customers because of the fact that this has happened,” Tasson said.

She urges advisors to develop a data security strategy, and ensure it’s updated periodically to reflect changing technology. The strategy should include specific efforts to protect data, such as password and data encryption processes.

“Encrypting is such a great tool,” Tasson said. “That’s definitely an additional step that can mitigate something bad from happening.”

The strategy should also include a protocol for dealing with a breach of data.

Tasson also urges advisors to review their record retention and destruction policies, and ensure they’re destroying records that are no longer necessary to keep for compliance purposes. She said many firms tend to keep these files for much longer than necessary

“Too often, organizations have all of this information that they really don’t need to keep,” she said. “It has little value to the company, but it actually can be a great treasure to some criminals and thieves.”

Advisors can also protect themselves from the costly impacts of potential privacy breaches with insurance, Tasson said. Many insurers offer policies designed to protect against this specific risk, and she said a growing number of advisors are signing up for this coverage as the threat continues expand.

Click here for more stories from the 2013 IFB Spring Summit.