Have ambitious super funds compromised member data?

Some superannuation funds have earned a stern warning from the regulator because they have been providing bulk extracts of sensitive member data, including individual tax file numbers to third party service providers.

The Australian Prudential Regulation Authority (APRA) has written to superannuation funds warning them against disclosing such sensitive data in their pursuit of consolidating a member's account and noting that the funds have been similarly warned by the Australian Taxation Office (ATO).

The letter, written by APRA's deputy chairman, Helen Rowell, said it was the regulator's view that "sending bulk unsolicited communications requesting members to enter personal data undermines the efforts made by financial institutions and the Australian Government to educate the public on safe online behaviour".

"It has become apparent that some RSE licensees, in order to facilitate the practices referred to above, are providing bulk extracts of sensitive member data, including individual tax file numbers (TFNs), to third party service providers," Rowell's letter said.

VIEW ALL

View all

"APRA has noted that sensitive member data has also been provided to third parties for other purposes such as business intelligence, customer analytics and marketing."

"APRA would like to remind RSE licensees of the risks inherent in such initiatives, including the outsourcing elements within them," the letter said. "RSE licensees are expected to maintain the usual rigour associated with outsourcing and risk management frameworks, and ensure that boards and senior management are fully informed and engaged in appropriate oversight of these arrangements."

The letter said that while innovative approaches to engagement with members were encouraged, it was essential that superannuation funds appropriately identified, assessed and managed the associated risks of new business processes.