The FCA has published the warning due to the current economic climate, which it says is changing the way many firms operate and may cause some to leave the market or merge with other firms. When this happens, the FCA says, firms must make sure they lawfully process and transfer client data.

The FCA reminds firms that they must comply with the Principles in the FCA Handbook, which require firms to organise and control their affairs responsibly and effectively, with adequate risk management systems (Principle 3). Before transferring clients’ personal data, firms should consider whether this is fair to and in the interests of their clients (Principle 6). Firms should also pay due regard to the information needs of their clients and communicate with them clearly and fairly (Principle 7).

Firms must also comply with data protection legislation, including the Data Protection Act 2018 (DPA), the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Privacy and Electronic Communications Regulations (EC Directive) 2003 (PECR).

The FCA reminds firms that the GDPR requires them to provide information to clients clearly setting out privacy information, which includes the purposes for which they are collecting or processing client data, and individuals’ rights when their data is processed. Firms should also generally ensure they maintain a record of how and why they process, share and retain personal data. In addition, firms should record the lawful basis for processing data. If they are processing data based on consent, they should maintain an effective audit trail of how and when consent was given.

The FCA reminds firms that it will act where it identifies breaches of relevant parts of the FCA Handbook. Firms that intend to transfer or receive personal client data must be able to demonstrate how they have considered the fair treatment of consumers and how their actions comply with data protection and privacy laws. To read the FCA press release in full, click here.