Loss of sensitive personal information.
Files were transported in uncollected crates by a removal company which the data controller did not have a contract with.
Undertaking issued to ensure that written contracts are used whenever third parties might have access to sensitive data and that clear and precise policies will be put into place for how to transport data while moving offices .
Reason for action
Contradictory instructions given to staff members by the removal company lead to confusion as to how the data could be transported, leading to errors made due to short notice.
11 April 2011.