Monthly Archives: June 2011

Cherubs Community Playgroup

Posted on by

What

Loss of sensitive personal data.

How much

47 records.

Why

Theft of an unencrypted laptop from the premises.

Regulator

ICO

Regulatory action

Undertaking issued to ensure that laptops containing sensitive personal information are encrypted and sufficient physical security measures are implemented.

Reason for action

The playgroup’s premises were located in a publically used building and security measures were only implemented during playgroup hours.

When

28 June 2011.

Links

View PDF of the Cherubs Community Playgroup Undertaking (Via ICO Website)

View PDF of the Cherubs Community Playgroup Undertaking (Breach Watch Archive)

Internet Eyes Limited

Posted on by

What

Loss of personal data.

How much

One record.

Why

A short video from the data controller’s security feed was posted on YouTube in which an individual was clearly recognisable.

Regulator

ICO

Regulatory action

Undertaking issued to ensure that  the transmission of data is sufficiently secure, and that an audit trail is implemented for all users.

Reason for action

The video stream of security footage across the internet was not encrypted and due to the lack of an audit trail it was impossible to determine how the video had been posted.

When

14 June 2011.

Links

View PDF of the Internet Eyes Limited Undertaking (Via ICO Website)

View PDF of the Internet Eyes Limited Undertaking (Breach Watch Archive)

Surbiton Children’s Central Nursery

Posted on by

What

Loss of personal data.

How much

21 records

Why

A teacher’s bag was stolen containing an unencrypted memory stick and paperwork.

Regulator

ICO

Regulatory action

Undertaking issued to ensure that portable data devices are encrypted  and that staff only take data off site when absolutely necessary.

Reason for action

The memory stick, containing personal data, was unencrypted.

When

14 June 2011.

Links

View PDF of the Surbiton Children’s Central Nursery Undertaking (Via ICO Website)

View PDF of the Surbiton Children’s Central Nursery Undertaking (Breach Watch Archive)

Surrey Council

Posted on by

Breach details

What Loss of sensitive personal information on three occasions.
How much 241 records.
When May – June 2010
Why Records were accidently sent out in an email copied to a global distribution list, minutes of a confidential strategy discussion erroneously emailed to a newsletter distribution group. Additional records were erroneously emailed to an incorrect internal email group.

Regulatory action

Regulator ICO
Action Monetary penalty of £ 120,000
When 9 June 2011

Why the regulator acted

Breach of act Emails were unencrypted and sent to the wrong recipients.
Inappropriate organisational and technical measures.
Known or should have known The risk of incorrect drop down boxes being selected were “self evident”.
Likely to cause damage or distress Records related to special needs.

Links

View PDF of the Surrey Council Monetary Penalty Notice (Breach Watch Archive)
View PDF of the Surrey Council Monetary Penalty Notice (Via ICO Website)

North Lanarkshire Council

Posted on by

What

Loss of sensitive personal data.

How much

Six records.

Why

A home support worker’s bag which contained hard copies of records relating to vulnerable individuals was stolen.

Regulator

ICO

Regulatory action

Undertaking issued to ensure that adequate security measures and implemented for hard copy documentation and that such documents contain the minimum amount of personal data necessary.

Reason for action

The home support worker’s bag was not locked and further investigation revealed that staff were given insufficient guidance about how to use and transport such documentation.

When

08 June 2011.

Links

View PDF of the North Lanarkshire Council Undertaking (Via ICO Website)

View PDF of the North Lanarkshire Council Undertaking (Breach Watch Archive)