Security Questions for Data Protection over the Phone?

joach

We have all experienced calling our Electricity Company, Bank or Mobile Phone network with a question about our account or bill and we are required to ask a number of security questions before anything can be discussed or handled. Sometimes we are asked four or five questions, it's very rare that it is enough to just give our name and account number. The companies will say they ask these questions for Data Protection reasons, which most people appreciate and understands. 
Is there an Irish or European law that specifies what credentials are required for an organisation before they disclose or handle a customer request over the phone?
 
I have found some suggested guidelines by the Data Protection Commissioner in Ireland, but none that are specific as to the number of questions required for an organisation to ask a customer before processing a request over the phone. Is the level of security and the number of questions asked entirely down to an organisation's own discretion?

Esel

They have to counteract social engineering attempts.

Peregrinus

joach wrote: »

. . . Is the level of security and the number of questions asked entirely down to an organisation's own discretion?

So far as I know, yes it is.

It's important to distinguish the "know your customer" requirements that banks, etc, have to comply with when you first open an account with them (asking for photo i.d., utility bills as proof of address, etc), which are regulated by law, and the security questions they ask over the phone ("Your date of birth? Mother's maiden name? Favourite flavour of icecream? The objectives of the French revolutionaries were not fully realised in practice: discuss"). In the later case they are just trying to satisfy themselves that the person who has called them on the phone claiming to be someone they already know really is someone they already know, and they set their own protocols and procedures for this.

The person you are dealing with may have no discretion or authority to talk to you about your banking business until you have satisfied all their requirements, but that's not because the law requires it; it's because his employers require it, and he'll be at risk of discipline or dismissal if he doesn't complete the identity checks properly.