Loss of sensitive personal data.
Personal data belonged to the data controller was dumped in a skip, which was later stolen.
Undertaking issued to ensure that staff are made aware of the data controller’s policy on the disposal of confidential waste
Reason for action
The data should never have been disposed of in a skip. The data controller had a written contract with a third party for the disposal of confidential waste, but on this occasion there was confusion as to the confidential nature of the waste.
15 March 2011.