Data security in financial services The UK Financial Services Authority has recently published a lengthy report on data security in the financial services sector which has the backing of the UK Information Commissioner.  In his forward to the report, which is aimed at assisting firms in preventing data loss by their employees and third party suppliers, Richard Thomas, the Information Commissioner says "it includes examples of good practice by some financial institutions which others could usefully learn from".  "Getting data protection wrong can bring commercial, reputation, regulatory and legal penalties.  Getting it right brings rewards in terms of customer trust and confidence", he adds.    The 100 page document reports on ways in which financial services firms in the UK are addressing information security risk and concentrates on the prevention of risk from within as opposed to examining the threat of data theft by criminals seeking to infiltrate financial services firms from outside.  The report is not intended to be a definitive opinion by the financial services authority but provides very useful guidelines and elements of risk management. The data protection team at Speechly Bircham continues to work with financial services clients on global data protection compliance as well as on information risk management.    Asia-Pacific data transfers Whilst many businesses are used to the rules for trans-border data flows within Europe and between Europe and other parts of the world, not too many businesses are aware of the work being carried out in the Asia Pacific countries. The International Chamber of Commerce is taking a leading role in providing Cross-Border Privacy Rules for the APEC privacy framework that were approved by APEC country leaders in 2004.    The Cross-Border Privacy Rules are intended to enable organisations that wish to implement uniform privacy policies and practices to do so on a harmonised basis within the Asia Pacific region which includes countries such as Australia, China, Japan, Korea, Mexico, Peru, Thailand, Vietnam and the United States.  The APEC initiative is not based upon strict legislation such as exists in the EU but more upon a framework of a mutual recognition by parties within APEC economies.    The Cross-Border Privacy Rules rely on businesses self assessing their compliance with the APEC privacy principles which are similar to the privacy principles of the US Safe Harbour and the seven data protection principles set out in the UK Data Protection Act 1998.  All of these principles emanate from the OECD guidelines on data privacy that were drafted many years ago and it remains to be seen if the APEC approach creates an efficient regime for protecting the rights of individuals in relation to personal data whilst at the same time encouraging good data protection practices between businesses.