3

I wanted to understand what elements of financial information need to be protected/encrypted. Understand that information like IBAN, bank account name, bank account number are personal data and need to be protected. Unsure whether the data elements such as bank bic code, bank swift code, bank cc, bank code are personal data?

2
  • The answer is "it depends." There are different jurisdictions and different regulatory bodies (e.g. FFIEC, PCI-DSS, ISO27K) If you are working with a financial institution, they should have a risk and compliance officer who can guide you. If you're in the UK, I'm pretty sure everything you listed is confidential PII.
    – John Wu
    Jan 4 at 8:45
  • but bank bic code, bank swift code, bank cc, bank code are public data and shouldn't considered be personal data from my pov. Example - a bank bic code identifies a specific bank when you make an international transaction, doesn't relate to any person Jan 4 at 10:38

2 Answers 2

3

AFAIK, all those data are personal data and have to be protected according to the laws of your country. For example in France the owner of the data should have the right to:

  • know what data you store
  • be allowed to fix any incorrect data
  • be allowed to have all its data removed from your files if they ask to
  • object to processing this data for marketing goals
  • object to processing this data for non-service related goals (EU General Data Protection Regulation)

In addition, as they are personal data, you must tell who is able to see them, what they are used for and who is responsable for the data processing (EU regulation). And the GDPR mandates that you describe the technical and organization measures that are applied to implement the data protection principles.

Yet they are not secret data, and provided you comply with the other regulation rules, encryption is not mandatory.

4
  • what is your justification behind - bank bic code, bank swift code, bank cc, bank code being personal data? they do not identify any individual directly or indirectly. Jan 4 at 10:42
  • @SoniaMishra: My birth date is not enough either to identify me, and it is not a secret. Yet I still think it to be a personal data. The BIC code is indeed public, what is personal data is the knowledge of what bank holds my account. Jan 4 at 11:07
  • bic code - Each bank has a unique BIC (Bank Identifier Code). ABN AMRO's BIC is ABNANL2A - I do not think this is personal data. Jan 4 at 15:58
  • @SoniaMishra: You probably know the BIC code of my bank, and I agree that it is not my data. What I do not want you to know is what bank is my bank, and this is personal data. Said differently if you have in indirection level with an internal code for the bank and an auxilliary table for the BIC number, then the BIC number is by no way personal data. But the internal value that links a bank and a human being is, and has to be protected. Jan 4 at 16:08
-2

The PCI DSS provides standards for the processes and systems that merchants and vendors use to protect information related to cards (in v4 the virtual cards will join the party as well). This information includes:

Cardholder data such as the cardholder’s name, the primary account number, and the card’s expiration date and security code.

Sensitive authentication data, including magnetic-stripe data, the equivalent data contained on a chip, and PINs.

All such information must be guarded per PCI DSS requirements when in the cardholder data environment (CDE).

Check page 8 from https://www.commerce.uwo.ca/pdf/PCI_DSS_v3-2-1.pdf Next to it, personal data or PII has to obey to GDPR regulation if the owner is EU citizen (neverming wherever the service is provided as a country).

8
  • This is for the credit card number, but what about the other items such as SWIFT? PCI-DSS doesn't cover that.
    – schroeder
    Jan 3 at 21:42
  • SWIFT code is the public identifier of the bank based on country and branch. Why would that be a sensitive/secret data? There is an ISO 9362 standard defined for it. Therefore you could start encrypting what the standards stands for and add the items as a result of your internal risk assessment and threat modeling. Jan 4 at 7:06
  • As it’s currently written, your answer is unclear. Please edit to add additional details that will help others understand how this addresses the question asked. You can find more information on how to write good answers in the help center.
    – Community Bot
    Jan 4 at 7:20
  • 1
    @SorinBaiuta the data elements like IBAN, bank account name, bank account number do not fall under PCI DSS. PCI data is cardholder data which includes - Primary Account Number (PAN), Cardholder Name, Expiration Date, Service Code And Sensitive Authentication Data which shouldn't be stored. This includes - Full Magnetic Stripe Data CAV2 / CVC2 / CVV2 / CID PIN / PIN Block Jan 4 at 10:41
  • 1
    @SorinBaiuta my question is whether the data elements - bank bic code, bank swift code, bank cc, bank code are personal data? (this is nowhere related to PCI DSS) Jan 4 at 10:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.