A bank mistakenly treated a customer’s request to change the office address as a change of correspondence address
The Complaint
The complainant was a customer of a bank (“the Bank”). The complainant visited a branch of the Bank and applied for a change of his office address in the bank records with the assistance of a staff member (“the Staff”). The complainant was dissatisfied that the Bank had mistaken his application as a change of his correspondence address, resulting in the complainant receiving correspondence from the Bank at his office address. The complainant hence lodged a complaint with the PCPD against the Bank for failing to maintain the accuracy of his personal data.
Outcome
The Bank said that in accordance with its established guidelines, when handling change of information requests, staff should check and ensure that the change of information form is completed with information clearly and accurately inputted, especially in respect of the item “the type of address to be changed”. The Bank stated that the Staff did not follow the above guidelines at the material time when processing the complainant’s change of information form and did not notice that “the type of address to be changed” had not been filled in on the form. As the Staff had confirmed with the complainant that his instruction was to change the office address when he visited the branch, the Staff filled in the relevant section for him without contacting the complainant. However, the Staff inadvertently checked the box for “Residential and Correspondence”, leading to the occurrence of the incident in this case.
Upon the intervention of the PCPD, the Bank reprimanded the Staff and explained to the staff of the branch concerned the procedures for handling updates of customers’ information, reminded them to seek the customer’s confirmation of the information to be changed and not to update missing or unclear information without the customer’s consent. The Bank also recommended its staff to use the designated application to handle the information update process to avoid missing any items in the forms.
Lesson learnt
Organisations may from time to time need to process requests from customers to update their personal data, and proper handling of requests for updating personal data is essential to maintaining the accuracy of personal data. To ensure accurate recording of the personal data that needs to be updated, data users should arrange for the data subjects to personally check and confirm the content to be updated as far as possible, and supplement with technical measures such as the checking function of electronic forms to ensure that the forms are completely filled in, so as to minimise the risk of impact on personal data accuracy that may arise from missing content.
(Uploaded in October 2025)