Policy background Information sharing
Large amounts of financial data flow through the UK every hour. The overwhelming majority of this data relates to legitimate activity. However, a small proportion involves criminal activity.
	The sharing of information between businesses, which would help them better detect, prevent and investigate criminal activity, is constrained by their duties of confidentiality. Particularly in the context of banking, this is known as the Tournier principle (from Tournier v National Provincial and Union Bank of England [1924] 1 KB 461).
	This has three main consequences:
First, a bank, for example, querying a particular transaction can only see its own data in relation to that transaction. It is unable to request further information from the other bank involved in the transaction to clarify relevant details. In the absence of confirmatory information, the bank may either end up under-reporting (not submitting a Suspicious Activity Report (SAR) to the UK Financial Intelligence Unit) or over-reporting (submitting a SAR when in fact none was necessary).
Second, a bank conducting an investigation into one of its customers – for instance for the purpose of complying with the MLR 2017 – can only see its own data in relation to that customer. This is despite the fact that economic crimes such as money laundering can take place across multiple bank accounts hosted by separate businesses.
Third, a bank who restricts access to its products, or terminates a relationship with a customer due to economic crime concerns, is unable to share that information with other businesses in the sector. This means that a customer whose account is terminated with a bank for economic crime reasons can easily open up an account with a new provider, without the new provider being aware of the original bank’s concerns.
	These provisions will make it easier for businesses covered by the provisions to share customer information with each other for the purposes of preventing, investigating, and detecting economic crime by disapplying civil liabilities owed to the person to whom the disclosed information relates (other than those incurred under the data protection legislation) where information is shared for these purposes. Businesses will therefore be able to take a much more proactive and timelier role in identifying and preventing criminal activity.
	The sections will allow direct sharing between relevant businesses Section 188 and indirect sharing through a third-party intermediary Section 189. Indirect sharing will apply in cases where the business has information about a customer that is relevant to preventing, detecting, or investigating economic crime, but does not know whom the information would assist, either now or in the future. This might occur where a business decides to terminate a relationship with a customer due to economic crime concerns and wants to ensure that any future business dealing with the customer is aware of their decision.
	The provisions can only be used for the purposes of preventing, detecting, and investigating economic crime. Economic crime in this instance is defined as any of the offences listed in Schedule 11 and includes: money laundering, sanctions evasion, fraud, bribery, terrorist financing, market abuse and tax evasion. Any disclosure of customer information for purposes other than those specified in the section would not qualify for the civil liabilities protections.
	The sections involve sharing information about customers in order to help inform other businesses’ risk-based decisions about these customers. They do not provide any additional powers for businesses to restrict services, or to exclude customers. In taking a decision whether to restrict access to a product, or exclude a customer, a business will still have to abide by its existing obligations, including ensuring that a decision is free from unlawful discrimination under the Equalities Act 2010. Unlawful discrimination against a customer on the basis of a protected characteristic will remain a breach of the law. Firms regulated by the Financial Conduct Authority (FCA) already have additional obligations to treat customers fairly under the FCA’s Regulatory Principles.
	Due to the thresholds set out in the sections, in particular that a business can only proactively share information about a customer or former customer if it has taken a decision to restrict its own services or exclude them itself (or would have taken the decision to do so in the case of a former customer). It is not anticipated that there will be a significant increase in the number of customers denied a product or excluded services. Rather, individuals who are already denied products or excluded services due to economic crime concerns will likely find it more difficult to access those same services elsewhere.
	To ensure that a customer’s data remains accurate and used only for the purposes specified in the Act, businesses must continue to adhere to the stipulations of the Data Protection Act 2018 and the UK GDPR (General Data Protection Regulation). The UK GDPR establishes principles around, amongst other areas, accuracy, purpose and fairness and transparency. Failure to adhere to these principles, for instance deliberately sharing incorrect data, would constitute a breach of the UK GDPR, the penalty for which is £17.5 million or 4 per cent of annual global turnover – whichever is greater. Where a customer believes their data rights have been breached, they can pursue a complaint via the Information Commissioner’s Office (ICO).
	Where a customer in the banking sector has found themselves denied or restricted a product from their bank and is unable to resolve the situation with the bank directly, they can pursue their case under the existing complaints procedure established by the Financial Ombudsman Service for individuals who have been denied products or services. In all cases – other than those where, for example, an individual’s account has been used for criminal activity or maintaining the account would breach other legal obligations such as those under the MLR 2017 – an individual will still have a right (as established in the Payment Accounts Regulations 2015) to a Basic Bank Account , ensuring that an individual who had their standard account terminated by a bank will still be able to access basic account services.
	The protections and appeals mechanisms outlined above are based upon those currently in place for the National Fraud Database (CIFAS) where customer information is shared between businesses for the purposes of preventing and detecting fraud.