The Bank of Scotland has been hit with a £75,000 fine for repeatedly faxing customers' account and personal details to the wrong recipients.
Over a three year period BoS - now part of Lloyds Banking Group - sent payslips, bank statements, account details and mortgage applications, along with customers' names, addresses and contact details, to the wrong people.
The mistake was first reported to the Information Commissioner's Office (ICO) in February 2009 by a third party which was sent at least 21 documents that should have gone to someone with a fax number one digit different.
Bank of Scotland was told several times about the issue but kept making the same mistake, even after the ICO was called in.
Stephen Eckersley, head, enforcement, ICO, says: "To send a person's financial records to the wrong fax number once is careless. To do so continually over a three year period, despite being aware of the problem, is unforgiveable and in clear breach of the Data Protection Act.
"Let us not forget that this information would have been all a criminal would ever need to carry out identity fraud. Today's penalty reflects the seriousness of this case."