What
Loss of sensitive personal data.

How much
Approximately 33,000 records.

Why
Documents containing a considerable amount of personal data were found in filing cabinet purchased second hand.

Regulator
ICO

Regulatory action
Undertaking issued to ensure that a formal written procedure is produced and implemented to ensure that any office furniture or equipment that is to be moved or disposed of is properly checked for personal data. Staff must be made aware of and trained to follow the data controller’s policy for the storage, use, or disposal of personal data.

Reason for action
The records were duplicates of documents held in the data controller’s office and contained extensive personal data. Enquiries revealed that the data controller had no formal written policy to ensure and document that cabinets or drawers were empty of personal data prior to disposal or removal.

When
11 January 2010

Links
View PDF of the Lancashire County Council Undertaking (Breach Watch Archive)