Breach details
| What | Theft of a camera memory card containing passport images of multiple job applicants. |
| How much | An unknown number. |
| When | December 2012. |
| Why | A memory card containing applicant passport photos was stolen from a camera owned by an employee, and thus fell outside the RVC’s policies and procedures. However, the possiblity of the use of personal devices in the workplace was not accounted for in these policies. Staff data protection training is also inadequate and is not being proactively addressed to prevent similar issues occurring in the future. |
Regulatory action
| Regulator | ICO | Action | Undertaking to comply with the seventh data protection principle. |
| When | 15 October 2013. |
| Details | The RVC is to implement mandatory induction and annual refresher training to all staff who routinely process personal information by 30 April 2014. This training is to be recorded and monitored, and follow-up procedures are to be implemented to ensure that all staff complete this training. In addition to training, all portable and mobile devices used to transmit personal data are to be encrypted and advice given on the use of personal devices. |
Links
| View PDF of the Royal Veterinary College Undertaking (Breach Watch Archive) |
| View PDF of the Royal Veterinary College Undertaking (Via ICO Website) |