Monthly Archives: November 2011

Worcestershire County Council

Posted on by

Breach details

What Inappropriate disclosure of sensitive personal information.
How much “A large number” of records.
When Unknown
Why A member of staff accidently clicked on an additional contact list while sending out an email intended for internal use and so two spreadsheets containing sensitive personal information were sent to 23 registered care providers.

Regulatory action

Regulator ICO
Action Monetary penalty of £ 80,000
When 28 November 2011

Why the regulator acted

Breach of act Staff were not provided with sufficient training and internal and external email distribution lists were not clearly differentiated.
Inappropriate organisational and technical measures.
Known or should have known Employees routinely dealt with confidential and sensitive personal data and manages should have realised the potential for human error when selecting emails lists.
Likely to cause damage or distress Details of vulnerable young adults.

Links

View PDF of the Worcestershire County Council Monetary Penalty Notice (Breach Watch Archive)
View PDF of the Worcestershire County Council Monetary Penalty Notice (Via ICO Website)

North Somerset Council

Posted on by

Breach details

What Inappropriate disclosure of sensitive personal information.
How much Two records.
When 12 November 2010
Why A council employee accidently sent five emails (on separate occasions), two of which contained highly sensitive information relating to a child’s serious case review, to the wrong NHS employee.

Regulatory action

Regulator ICO
Action Monetary penalty of £ 60,000
When 28 November 2011

Why the regulator acted

Breach of act Staff not given sufficient information governance training and management should have signed off on emails, ensuring that all sensitive data was encrypted.
Inappropriate organisational and technical measures.
Known or should have known Data controller was used to handling confidential and sensitive data and should have been aware of the “self evident” risks of drop down email menus. Repeated breaches demonstrate this fact.
Likely to cause damage or distress Data related to vulnerable individuals and could be misused.

Links

View PDF of the North Somerset Council Monetary Penalty Notice (Breach Watch Archive)
View PDF of the North Somerset Council Monetary Penalty Notice (Via ICO Website)

London Borough of Southwark

Posted on by

What

Loss of sensitive personal data.

How much

7,200 records.

Why

An unencrypted iMac and paper records were found by a member of the public in a skip being used to cleanse a decommissioned and vacant property that had previously been part of a complex previously owned by the data controller.

Regulator

ICO

Regulatory action

Undertaking issued to ensure that the data controller will demonstrate adherence to the action plans to deal with the issue that it has presented to the data commissioner and that it will honour its invitation for the ICO to conduct a data protection audit.

Reason for action

Although the Data Controller demonstrated plans to deal with the breach, the iMac had been missing since 2003 and was unencrypted and any member of the public would have been able to remove the data contained on it.

When

21 November 2011.

Links

View PDF of the London Borough of Southwark Undertaking (Via ICO Website)

View PDF of the London Borough of Southwark Undertaking (Breach Watch Archive)

Central Essex Community Services

Posted on by

What

Loss of sensitive personal data.

How much

249 records.

Why

Loss of a birth book from a locked storage room.

Regulator

ICO

Regulatory action

Undertaking issued to ensure that sufficient physical security measures are in place for the storage of paper medical records and compliance with these measures are monitored.

Reason for action

The birth book was supposed to be locked in a filing cabinet in accordance with the data controller’s policy, but it was stored on top of the cabinet due to a lack of storage space.

When

21 November 2011.

Links

View PDF of the Central Essex Community Services Undertaking (Via ICO Website)

View PDF of the Central Essex Community Services Undertaking (Breach Watch Archive)

Ruth Crawford QC

Posted on by

What

Loss of sensitive personal data.

How much

Unknown.

Why

Theft of an unencrypted laptop from the Data Controller’s home.

Regulator

ICO

Regulatory action

Undertaking issued to ensure that personal media devices used to store data are sufficiently encrypted.

Reason for action

Although it was concluded that the laptop was suitably secure physically, insufficient technical security measures were taken.

When

16 November 2011.

Links

View PDF of the Ruth Crawford QC Undertaking (Via ICO Website)

View PDF of the Ruth Crawford QC Undertaking (Breach Watch Archive)

Phoenix Nursery School

Posted on by

What

Loss of sensitive personal data.

How much

Unknown.

Why

A backup tape and supporting device containing details of pupils, parents and guardians was lost.

Regulator

ICO

Regulatory action

Undertaking issued to ensure that in the future all personal data is encrypted to a sufficient standard and that current operational procedures are reviewed and revised.

Reason for action

While the backup tape did not appear to have been stolen, it could not be located. The data controller contacted all parents and guardians effected by the incident to advise them accordingly. However although the data on the device was recovered in full, the Commissioner’s investigation revealed that the technical measures employed by the school were inadequate.

When

16 November 2011.

Links

View PDF of the Phoenix Nursery School Undertaking (Via ICO Website)

View PDF of the Phoenix Nursery School Undertaking (Breach Watch Archive)

Oliver Letwin, MP

Posted on by

What

Loss of sensitive personal data.

How much

“Numerous”

Why

The data controller was disposing of documents in public waste bins in St James’ Park.

Regulator

ICO

Regulatory action

Undertaking issued to ensure that any documents containing personal data must be disposed in a secure manner, such as shredding, pulping or incineration.

Reason for action

Some of the documents disposed of in the public waste bins included personal information such as names and addresses.

When

15 November 2011.

Links

View PDF of the Oliver Letwin MP Undertaking (Via ICO Website)

View PDF of the Oliver Letwin MP Undertaking (Breach Watch Archive)

Rochdale Metropolitan Borough Council

Posted on by

What

Loss of personal data.

How much

“Thousands”

Why

Loss of an unencrypted USB stick.

Regulator

ICO

Regulatory action

Undertaking issues to ensure that all portable media devices used to store personal data are sufficiently encrypted and that policies and procedures on the storage, processing, transmission and disposal of personal data shall be reviewed and revised by no later than 1 December 2011.

Reason for action

Although much of the data on the USB stick was already available in the public domain it became clear during investigations that data protection training was insufficient and that encrypted memory sticks were not provided in those cases when more private data would have been stored.

When

03 November 2011.

Links

View PDF of the Rochdale Metropolitan Borough Council Undertaking (Via ICO Website)

View PDF of the Rochdale Metropolitan Borough Council Undertaking (Breach Watch Archive)