An IT error discovered at the Central Bank means that 20,500 borrowers may have had incorrect credit risks applied to their accounts

More than 20,000 borrowers may have been unfairly assessed for loans or credit assessments because of an IT error at the Central Bank.

The error, discovered by the Central Bank when a member of the public complained earlier this month, is being described by the Central Bank as a data breach and has also been reported to the Data Protection Commissioner.

“As a consequence of this error, certain borrower information was retained on the Central Credit Register [CCR] for up to an additional three months, and included in credit reports, when it should not have been retained or included,” the bank said in a statement today.

The institution says that the mishap is the consequence of an “archiving error”.

The IT error comes at an embarrassing time for the Central Bank, as it begins to look into a major IT failure at Bank Of Ireland that caused havoc with online bank accounts and ATMs last week.

The Central Bank says that it has notified other banks of the error.

“The Central Bank’s investigation so far has determined that, of the approximately 476,000 total enquiries made by lenders or borrowers for information held on the CCR over the period between 1 June and 7 August 2023, the records of around 20,500 borrowers contained performance data pointing to repayment difficulties in May, June or July 2018,” the bank added.

This could have negatively impacted those borrowers’ ability to access finance.

“This could be the case where the records pointed to repayment difficulties during the additional, outdated, three months or [where] lenders or borrowers had sought to access those records over the period between 1 June and 7 August 2023,” the Central Bank said.

However, the institution says that there is no security risk to the personal data.

“We wish to state clearly that borrowers’ data has not been compromised or accessed by any unauthorised third parties as a consequence of this error,” it said.

The issue came to light, the bank said, after a member of the public brought it to the bank’s attention earlier this month.

“As a result of this error, additional, outdated information relating to these three months was available on the CCR database for inclusion in credit reports issued to borrowers and lenders in the period 1 June to 7 August 2023. While this information was accurate, the additional three months of information should not have been made available, and constitutes a data breach under data protection legislation.”

The glitch happened due to a technical error that affected the automated deletion process of historical records in the CCR, the bank added.

“It is important to note that the information held on the CCR is one of many factors that lenders use to determine whether a loan is approved or not,” the Central Bank said.

“In addition, the fact that lenders made a request for information on the CCR does not mean that those specific pieces of information were used by lenders in their credit decisions. For example, the Central Bank’s analysis so far has determined that the records of a significant proportion of the 20,500 borrowers continued to point to performance difficulties in the months following May, June and July 2018. At this stage, therefore, the Central Bank is not in a position to determine with accuracy the extent to which credit applications were adversely affected by this incident.”