Cardiff City Council

Posted on by

Breach details

What Failure to meet the requirements of section 7 of the Act.
How much One complaint.
When 21 July 2011
Why The Council failed to respond to a subject access request within the 40 days prescribed period. The Commissioner found that there were systematic failures to meet section 7.

Regulatory action

Regulator Undertaking to comply with the sixth data protection principle
Action ICO
When 28th August 2013.
Details The Council shall immediately set up clearly defined and managed procedures for dealing with subject access requests and provide staff with the appropriate training. This should include measures for the storage of paper records to ensure that subject access requests are responded to promptly and appropriately.

Links

View PDF of the Cardiff City Council Undertaking (Breach Watch Archive)
View PDF of the Cardiff City Council Undertaking (Via ICO Website)

Follow Up

The ICO conducted a follow up assessment on 7 March 2014 (published on 14 March).
View PDF of the Cardiff City Council Undertaking Follow Up (Breach Watch Archive)
View PDF of the Cardiff City Council Undertaking Follow Up (Via ICO Website)

Aberdeen City Council

Posted on by

Breach details

What Four documents containing sensitive personal information were accidentally uploaded to the internet by a member of staff working from home. The data includes names and addresses, dates of birth, details of alleged criminal offences, and information about Social Care cases concerning children.
How much Four documents totalling 39 pages.
When 8 November 2011 to 18 February 2012.
Why A Council employee inadvertently downloaded four sensitive documents onto her PC when accessing them from home (either by email or by USB) between 8 November and 12 November 2011. These were then uploaded to a website by an auto-upload program pre-installed on the computer thereby making the data available to the public. The documents were discovered on 15th February 2012 and were removed (along with all cached versions) within four hours. However, on 18th February a national newspaper published a story on this incident although personal data was not included after a discussion with the Council.

Regulatory action

Regulator ICO
Action Monetary penalty of £100,000.
When 27 August 2013

Why the regulator acted

Breach of act Breach of the Seventh Data Protection Principle: the Council failed to introduce a secure home working policy or provide the training and equipment to make the home a secure place to work.
Known or should have known The Council was clearly aware that there were inherent risks with staff accessing sensitive personal data at home as it had an acceptable use policy. However, the Council did not supply the necessary equipment to make homes secure places to work from.
Likely to cause damage or distress The disclosure of personal information of the data subjects is likely to cause them substantial distress, particularly when this information was supposed to be dealt with in confidence. The data is particularly sensitive as it identifies vulnerable individuals.There is also the risk that the information may have been further disseminated and misused.

Links

View PDF of the Aberdeen City Council Monetary Penalty Notice (Breach Watch Archive)
View PDF of the Aberdeen City Council Monetary Penalty Notice (Via ICO Website)

Local Government Ombudsman (the LGO)

Posted on by

Breach details

What A bag containing an encrypted portable media device and hard copy papers relating to planning application complaints. This included sensitive personal information relating to one of the complainant’s physical or mental health.
How much 8 complaints.
When Unknown.
Why A bag containing sensitive personal information was stolen from one of Ombudsman’s investigators at a public house. There was a specific reason for the papers to be taken out of the office and a policy on security on information while in transport existed, but staff were unaware of the policies due to a lack of training.

Regulatory action

Regulator ICO
Action Undertaking to comply with the seventh data protection principle
When 22 August 2013
Details The company shall provide mandatory annual training to all staff whose role includes the routine processing of personal information. The company shall also ensure that all staff are aware of its policies relating to personal information and are updated of any changes to these policies.

Links

View PDF of the Local Government Ombudsman (the LGO) Undertaking (Breach Watch Archive)
View PDF of the Local Government Ombudsman (the LGO) Undertaking (Via ICO Website)

Islington Borough Council

Posted on by

Breach details

What Spreadsheets containing sensitive personal data in a ‘hidden’ workbook were uploaded on three occasions to the WhatDoTheyKnow.com FOIA website in response to an FOIA request. The data included details on housing applicants’ sexuality, ethnicity, domestic violence and criminal offending.
How much 2,375 records.
When 26 June 2012
Why Spreadsheets prepared by one department providing a response to an FOIA request used pivot tables to provide the summary information requested, however the published spreadsheets also contained the raw source data in hidden worksheets within the same spreadsheet. The request originated via the WhatDoTheyKnow website which automatically publishes all FOIA responses to the web, making them publicly available .

Regulatory action

Regulator ICO
Action Monetary Penalty notice of £70,000
When 20 August 2013

Why the regulator acted

Breach of act Breach of the Seventh Data Protection Principle: the Council did not have processes in place to ensure that personal information was not published in response to an FOIA request and failed to provide adequate training for the staff dealing with FOIA responses (such as how to check for hidden data within Excel).
Known or should have known The Council should have known that in the absence of a robust checking policy, personal data may be exposed in response to an FOIA request.
Likely to cause damage or distress The disclosure of sensitive personal information of the data subjects would cause them substantial distress, particularly as it is known that the information had been downloaded by unknown third parties seven times. The Council is facing separate legal action from a number of the data subjects. The Commissioner also noted that there is a risk that the information could be further disseminated and misused, potentially leading to identity fraud and possible financial loss.

BW Observations

If the ICO considered an MPN appropriate, then a penalty of £70,000 for the repeated release of 2,375 items of sensitive personal data to a public website seems good value for the Data Controller. However the basis for the ICO’s assertion that the Council ‘knew or should have known’ appears to be weak.

Links

View PDF of the Monetary Penalty Notice (Breach Watch Archive)
View PDF of the Monetary Penalty Notice Via ICO Website)

Foyle Women’s Aid

Posted on by

Breach details

What Confidential client information contained in a folder was left at a cafe.
How much A folder containing information on one case.
When June 2012
Why A lack of effective controls and procedures for taking information out of the office contributed to the loss of this personal data. Excessive information was also being transported as the folder contained personal data not relevant to the scheduled meetings. However, there were general polices and procedures in place and the support worker had received relevant training. The support worker was also acting against previous instructions given by Foyle Women’s Aid.

Regulatory action

Regulator ICO
Action Undertaking to comply with the seventh data protection principle.
When 13 August 2013.
Details Foyle Women’s Aid will immediately implement a formal policy covering the use of personal data outside of the office and provide training to their staff; compliance with these policies shall be regularly monitored. Portable devices used for the storage and transmission of personal data must be encrypted. Physical and other security measures must also be implemented to protect against unauthorised access to personal data.

Links

View PDF of the Foyle Women’s Aid Undertaking (Breach Watch Archive)
View PDF of the Foyle Women’s Aid Undertaking (Via ICO Website)

Follow Up

The ICO conducted a follow up assessment on 19 November 2013.
View PDF of the Foyle Women’s Aid Follow Up (Breach Watch Archive)
View PDF of the Foyle Women’s Aid Undertaking Follow Up (Via ICO Website)

Northern Health and Social Care Trust

Posted on by

Breach details

What Personal data including information on physical or mental health.
How much An unknown number of incidents including the faxing of confidential service user information to the wrong recipient and the inappropriate disclosure of personal data to professionals working with the Trust.
When An unknown period, dating to at least May 2011.
Why A number of security incidents led to the Commissioner’s investigation into the Trust. It was discovered that most of the staff involved in these incidents had not received the supposedly mandatory Information Governance training, and the Trust failed to monitor and enforce staff completion of training. This led to staff being unaware of Information Governance policies.

Regulatory action

Regulator ICO
Action Undertaking to comply with the seventh data protection principle.
When 13 August 2013.
Details From the date of this undertaking staff are to be made aware of policies regarding the storage and use of personal data and are given appropriate training in this and in dealing with security breaches. Measures should be put in place to ensure that staff attend all mandatory training. In addition, portable devices used to store personal data must be encrypted.

Links

View PDF of the Northern Health and Social Care Trust Undertaking (Breach Watch Archive)
View PDF of the Northern Health and Social Care Trust Undertaking (Via ICO Website)

Follow Up

The ICO conducted a follow up assessment in December 2013 (published on 10 January 2014).
View PDF of the Northern Health and Social Care Trust Follow Up (Breach Watch Archive)
View PDF of the Northern Health and Social Care Trust Undertaking Follow Up (Via ICO Website)

Derbyshire, Leicestershire and Nottinghamshire Police Forces

Posted on by

Breach details

What The theft of laptops containing sensitive personal data including prison records and offender details.
How much Approximately 4,500 records held on eight laptops.
When 14 August 2010.
Why These police forces were part of the East Midlands Collaboration Unit (EMCU), whose offices were burgled in August 2010. Eight laptops belonging to seconded offices were stolen; they had not been stored in available lockable containers and two were unencrypted. Derbyshire and Leicestershire Police had not undertaken their own risk assessments and relied on the security measures of Nottingham Police. However, this did not specify that laptops should be encrypted, made no provision for locking them in containers, and did not monitor the offices during this period.

Regulatory action

Regulator ICO
Action Enforcement Notice issued to limit the sharing of personal data.
When 18 June 2013
Details These police forces shall only share personal data as part of a collaborative project if a Senior Information Risk Owner has been appointed to oversee the work and risk assess the premises; laptop and other portable electronic security devices are encrypted; and all officers involved in the project are given appropriate training. These measures should been implemented within 35 days.

Links

View PDF of the Derbyshire Police Enforcement Notice (Breach Watch Archive)
View PDF of the Derbyshire Police Enforcement Notice (Via ICO Website)
View PDF of the Leicestershire Police Enforcement Notice (Breach Watch Archive)
View PDF of the Leicestershire Police Enforcement Notice (Via ICO Website)
View PDF of the Nottinghamshire Police Enforcement Notice (Breach Watch Archive)
View PDF of the Nottinghamshire Police Enforcement Notice (Via ICO Website)

Hertfordshire Constabulary

Posted on by

Breach details

What Breach of the First and Third Data Protection Principles and the European Convention on Human Rights.
Personal data in the form of vehicle numberplates.
How much An unknown number of records.
When Unknown.
Why Currently all vehicles entering and leaving Royston have their numberplates recorded by ANPR cameras. Although this data can only be accessed in limited circumstances the Commissioner is concerned it could be used for other purposes, and there is a risk of its unauthorised or unlawful access.

Regulatory action

Regulator ICO
Action Enforcement Notice Issued to Hertfordshire Constabulary.
When 15 July 2013.
Details Enforcement notice issued to ensure that within 90 days the personal data recorded by the ANPR cameras will no longer be processed without a Privacy Impact Assessment.

Links

View PDF of the Hertfordshire Constabulary Enforcement Notice (Breach Watch Archive)
View PDF of the Hertfordshire Constabulary Enforcement Notice (Via ICO Website)

Bank of Scotland

Posted on by

Breach details

What Personal information including national insurance numbers, bank details, and photocopies of passports and driving licenses was faxed to a number of incorrect recipients.
How much An unknown number of records.
When February 2009 to February 2013.
Why During this four year period a number of faxes containing personal information were sent to incorrect recipients rather than the bank’s certal processing systems. These breaches occurred on different faxes in different locations, and were made by a large number of staff from different branches. This was due to misdialling and in particular the transposition of the numbers 2 and 8. Although the employees concerned were given training on this issue and a communication was sent alerting all members of staff to the issue of misdialling, this particular error was not raised.

BW Comments

The ICO has on many occasions indicated his dislike of faxing, especially if the errors occurred because of manual misdialling which could be rectified by only allowing pre-programmed numbers.

Regulatory action

Regulator ICO
Action Monetary penalty of £ 75,000.
When 30 July 2013.

Why the regulator acted

Breach of act Breach of the Seventh Data Protection Principle: the bank failed to provide adequate training or to find a more secure means for the transmission of personal information.
Known or should have known The bank was aware that there were risks associated with sending information by fax as it had procedures in place to regulate this and instituted some training on the discovery of the first breach. However, the continuation of these breaches is testimony to the inefficacy of the taken measures.
Likely to cause damage or distress The disclosure of personal information of the data subjects is likely to cause them substantial distress, particularly when this information was supposed to be dealt with in confidence. It also carries the risk that the information could be further disseminated and misused, potentially leading to identity fraud and possible financial loss.

BW Observations

This is the third breach where a regulated firm where the FCA (FSA) has not taken action and has let the ICO take the lead in respect of a breach of personal data.

Links

View PDF of the Bank of Scotland Monetary Penalty Notice (Breach Watch Archive)
View PDF of the Bank of Scotland Monetary Penalty Notice (Via ICO Website)

Janet Thomas

Posted on by

Breach details

What Personal data and sensitive personal data included in CVs.
How much 7,435 records.
When 11 April 2012.
Why CV documents were being stored unprotected on the website www.janetpage.com, in an area that was intended to be a secure portal for prospective employers. However, any member of the public could access and download these documents which included information about candidates’ ethnicity, religion, and sexuality.

BW Comments

A reminder that unless you work very hard, documents on a website are very easily accessible.

Regulatory action

Regulator ICO
Action Undertaking to comply with the seventh data protection principle.
When 16 July 2013.
Details The company shall implement and monitor technical security measures on its website to protect personal data. This data should only be collected when necessary. Staff should also receive data protection training.

BW Observations

Given the background to the ACS Law MPN it is perhaps surprising that an obviously poorly-configured and amateur website containing (sensitive) personal data didn’t receive more than an undertaking from the commissioner. However as a jobseeker typically wants their CV circulated as widely as possible it would be hard for the ICO to establish that the breach of CVs from such a site was likely to cause the Data Subjects damage or distress.

Links

View PDF of the Janet Thomas Undertaking (Breach Watch Archive)
View PDF of the Janet Thomas Undertaking (Via ICO Website)