Anyone see end of the world problems with employees taking loan files home to work evenings or weekends? How do you think our examiners will view this practice?

Although I have been guilty in the past of doing so, I totally recommend that this NOT be done! Your auto could be stolen.....someone could break into your house.....many ways this could cause a privacy issue.

Yea, right. And if I didn't bring work home, what would I do during those sleepless hours. Its not like I'm going to get a life or something.

While I agree, it is difficult to practice. But remember, the same goes for the laptop you carry, possibly e-mails and attachments on your PDA and files on your home PC as well as the media used to transport those files from work to home, if you have confidential documents. (These go beyond customer records, audit results, budgets, employee information, etc.)

------------------
Andy Zavoina
Opinions stated are not necessarily that of my employer.

Once again, I'm the Privacy Grinch. If someone steals my car and there is customer information in the car, I have not shared nonpublic personal information. This is not a privacy issue. Privacy is designed to stop the sharing of nonpublic personal information with 3rd parties - not prevent all fraud and crime.

What does your information security policy say about this? Does it provide that all files will be locked up after hours? While the privacy reg does not specifcally try to protect against all crime and fraud, it does address it with the security section. I would think that there would be some civil liability if the customer's info was stolen from your home or car and your information security policy stated that everything would be locked up at night with no provisions for certain personnel taking work home with them.

Ditto Louvera.

I'd also wager that your bank's insurance bond has something to say about this.

------------------
- Bart Jonker, CRCM

Opinions stated are not legal advice, and are not necessarily the opinions of OAK Financial Corp.

I agree with those advising not to do this (although I know it happens). Many banks privacy statements say that they will safeguard the customers information....so it goes beyond NPI sharing. You've made a promise and said you have policies and processes in place to safeguard.

Folks:

There are actually several issues to consider -- and although taking work home is a common business practice, it's also a very poor one. Privacy regulations notwithstanding, these work files contain information that an offender may find valuable. Treat these files with the same degree of care as you would use with an employee's personnel file.

If taking work files home is absolutely essential, develop a "log-out/log-in" process that requires personal accountability, because:
1. If the loss or theft of the information creates a financial loss to the bank, the bank's insurance may choose not to cover the loss -- and your homeowner's insurance likely won't, either;
2. Only take copies of original files (stamped "Confidential -- to be shredded) home and leave the originals at the bank -- taking original documents offsite is a common practice of embezzlers who need to destroy evidence; and
3. Use the information, note the file that copies were made and return the copies to the appropriate person for shredding.

Is this a lot of work? Of course. Is it worth it? Let's give you two (2) teenagers who live at home, a couple of customer files and an errand.

You leave your briefcase containing the files at home and you make a quick trip to the store. Your kids each have a friend who visits your house while you're at the store. One of the friends looks into your briefcase and sees the files. He opens one of the files and sees credit card information.

He uses the credit card information to buy $1,000.00 worth of CDs (compact disks). The customer protests and the subsequent investigation reveals that the information was obtained from the files that you took home. You get to testify about your actions during the trial. Your image and reputation -- and your bank's -- will never be the same.

Remember that the best information security tool that you have available is the ability to deny access to the information. Access is the first and most important thing that an offender needs in order to commit a crime -- any crime.

------------------
Dana Turner
Security Education Systems
danaturner@bankersonline.com
830-535-6500
Opinions expressed are always those of my employer.