Inappropriate disclosure of personal and sensitive personal data on several occasions.
29 records at minimum.
On one occasion an individual received a letter relating to alleged benefit fraud concerning a third party and received a list of 29 occupants residing at two supported housing properties. Additionally on two later occasions customer details were inappropriately disclosed and personal data was made available online for a several days.
Undertaking issued to ensure that a formal policy for the disposal of confidential waste be written and implemented.
Reason for action
These numerous breaches in close proximity highlighted a lack of sufficient training and security measures relating to data protection amongst staff. The Commissioner is satisfied that the data controller will implement suitable remedial steps however
10 February 2012.