Loss of sensitive personal data.
How much
About 200 records.
Why
A mini-Mac computer and several laptops were stolen from an academic office of the data controller in a teaching hospital.
In a second incident several months later two laptops were stolen from another teaching hospital.
Regulator
ICO
Regulatory action
Undertaking issued to ensure that all portable media devices used to store or transmit personal data are suitably encrypted. Physical security measures must at all times be adequate to prevent unauthorised access to personal data Staff must be made aware of and trained to follow the data controller’s policy for the storage, use, retention, or disposal of personal data.
Reason for action
None of the machines were encrypted and it was discovered that the laptops were not normally locked away or physically secured when not in use. Enquiries revealed that staff training and awareness in relation to data protection responsibilities were inadequate. A similar incident had occurred in June 2009 but the data controller did not appear to have incorporated lessons learnt from that incident sufficiently into its wider policies and procedures.
When
5 May 2010
Links
View PDF of the King’s College London Undertaking (Breach Watch Archive)