Category Archives: ICO enforcement notice

Treasury Solicitor’s Department

Posted on by

Breach details

What Disclosure of personal data.
How much 4 records.
When 06 February 2012, 24 August 2012, 30 August 2012 and 3 January 2013.
Why Three of these breaches involved case files containing un-redacted third party personal information to a claimant’s solicitor and the claimant themself. The fourth breach involved the sending of a case of papers relating to an unfair dismissal claim to an individual, although the papers contained personal information relating to another individual’s claim. All four of these breaches were self-reported. The Solicitor’s Department have some measures in place to safeguard personal data but there are gaps which are preventing further compliance.

Regulatory action

Regulator ICO
Action Undertaking to comply with the seventh data protection principle.
When 26 February 2014.
Details The Solicitor’s Department is to implement a clear, documented procedure for the preparation of information for disclosure within six months, as well as creating a structured, formal procedure concerning communication requirements between Junior and Senior lawyers carrying out the disclosure process. Mandatory training about the requirements of the Act is also to be given to all staff.

Links

View PDF of the Treasury Solicitor’s Department Undertaking (Breach Watch Archive)
View PDF of the Treasury Solicitor’s Department Undertaking (Via ICO Website)

Derbyshire, Leicestershire and Nottinghamshire Police Forces

Posted on by

Breach details

What The theft of laptops containing sensitive personal data including prison records and offender details.
How much Approximately 4,500 records held on eight laptops.
When 14 August 2010.
Why These police forces were part of the East Midlands Collaboration Unit (EMCU), whose offices were burgled in August 2010. Eight laptops belonging to seconded offices were stolen; they had not been stored in available lockable containers and two were unencrypted. Derbyshire and Leicestershire Police had not undertaken their own risk assessments and relied on the security measures of Nottingham Police. However, this did not specify that laptops should be encrypted, made no provision for locking them in containers, and did not monitor the offices during this period.

Regulatory action

Regulator ICO
Action Enforcement Notice issued to limit the sharing of personal data.
When 18 June 2013
Details These police forces shall only share personal data as part of a collaborative project if a Senior Information Risk Owner has been appointed to oversee the work and risk assess the premises; laptop and other portable electronic security devices are encrypted; and all officers involved in the project are given appropriate training. These measures should been implemented within 35 days.

Links

View PDF of the Derbyshire Police Enforcement Notice (Breach Watch Archive)
View PDF of the Derbyshire Police Enforcement Notice (Via ICO Website)
View PDF of the Leicestershire Police Enforcement Notice (Breach Watch Archive)
View PDF of the Leicestershire Police Enforcement Notice (Via ICO Website)
View PDF of the Nottinghamshire Police Enforcement Notice (Breach Watch Archive)
View PDF of the Nottinghamshire Police Enforcement Notice (Via ICO Website)

Hertfordshire Constabulary

Posted on by

Breach details

What Breach of the First and Third Data Protection Principles and the European Convention on Human Rights.
Personal data in the form of vehicle numberplates.
How much An unknown number of records.
When Unknown.
Why Currently all vehicles entering and leaving Royston have their numberplates recorded by ANPR cameras. Although this data can only be accessed in limited circumstances the Commissioner is concerned it could be used for other purposes, and there is a risk of its unauthorised or unlawful access.

Regulatory action

Regulator ICO
Action Enforcement Notice Issued to Hertfordshire Constabulary.
When 15 July 2013.
Details Enforcement notice issued to ensure that within 90 days the personal data recorded by the ANPR cameras will no longer be processed without a Privacy Impact Assessment.

Links

View PDF of the Hertfordshire Constabulary Enforcement Notice (Breach Watch Archive)
View PDF of the Hertfordshire Constabulary Enforcement Notice (Via ICO Website)

Google Inc

Posted on by

Breach details

What Personal data not destroyed.
How much 5 disks containing an unknown number of records.
When February 2012
Why In May 2010 it was discovered that Street View vehicles had mistakenly collected payload data for thousands of individuals. This was deleted in November 2010. In February 2012 four disks were discovered to have been accidentally retained, and in October 2012 a fifth disk was discovered (although this may contain some data not collected in the UK).

Regulatory action

Regulator ICO
Action Enforcement Notice Issued to Google Inc
When 11th June 2013
Details Enforcement notice issued to ensure that all personal data held on vehicle disks and collected in the UK using Street View vehicles shall be destroyed with 35 days. Any disks discovered in the future holding personal data collected in the UK should be reported to the Information Commissioner.

Links

View PDF of the Google Inc Enforcement Notice (Breach Watch Archive)
View PDF of the Google Inc Enforcement Notice (Via ICO Website)

Glasgow City Council

Posted on by

Breach details

What Two unencrypted laptops containing substantial amounts of personal data were stolen from offices undergoing refurbishment.
How much An unknown number of records.
When Unknown
Why An earlier enforcement notice was issued in 2010. Since then, previous thefts had occurred from the Council’s offices and physical security had not been improved. In addition, unencrypted laptops were still being issued and over 70 unencrypted laptops were unaccounted for.

BW Comments

A Monetary Penalty Notice was issued to Glasgow in respect of this breach but the quality of IT asset management at the Council was obviously so poor that the ICO felt it needed to issue an enforcement notice as well.

Regulatory action

Regulator ICO
Action Enforcement Notice
When 04 June 2013
Details Enforcement Notice issued to ensure that asset management is improved. A full audit of existing IT assets relating to personal information must be undertaken by 30 June 2013, along with asset management training for managers and reissuing information security guidelines to staff. A new asset register must be completed by 31 July 2013 and updated on a yearly basis.

BW Observations

Interestingly the enforcement notice didn’t re-enforce the 2010 instruction to encrypt laptops.

Links

View PDF of the Glasgow City Council Enforcement Notice (Breach Watch Archive)
View PDF of the Glasgow City Council Enforcement Notice (Via ICO Website)

Stoke-on-Trent City Council

Posted on by

Breach details

What Loss of sensitive personal information.
How much 11 records.
When 14 December 2011
Why 11 unencrypted emails relating to a child protection case were sent to the wrong email address by mistake.

Regulatory action

Regulator ICO
Action Monetary penalty of £ 120,000
Enforcement notice issued to ensure that a training program to make staff aware of data protection security procedure is arranged within 35 days.
When 25 October 2012

Why the regulator acted

Breach of act Failure to take appropriate technical and organisational measures against unauthorised processing of personal data, in particular a failure to train employees appropriately and provide a secure means of sending email.
Known or should have known Staff were used to handling confidential and sensitive personal data and the danger of sending unencrypted email, which the data controller was aware was occuring, should have been self evident.
Likely to cause damage or distress Data was confidential and highly sensitive and related to an ongoing legal case.

Links

View PDF of the Stoke-on-Trent City Council Monetary Penalty Notice (Breach Watch Archive)
View PDF of the Stoke-on-Trent City Council Monetary Penalty Notice (Via ICO Website)
View PDF of the Stoke-on-Trent City Council Enforcement Notice (Breach Watch Archive)
View PDF of the Stoke-on-Trent City Council Enforcement Notice (Via ICO Website)

Southampton City Council

Posted on by

What
Breach of the Data Protection Act

How much
Unknown.

Why
The data controller required taxi operators to record all conversations and images while the vehicles were in use.

Regulator
ICO

Regulatory action
Enforcement Notice issued, requiring the data controller to erase any personal data in the audio recordings that have already been obtained and held, and refrain from recording any such personal data in the future.

Reason for action
The recording policy was considered unnecessary and fundamentally invasive to private individuals using the car, be they driver or passenger.

The Enforcement notice was upheld on appeal to the first-tier (Information Rights) tribunal.When
7 February 2012

Links
View PDF of the Southampton City Council Enforcement Notice (Via ICO Website)

View PDF of the Southampton City Council Enforcement Notice (Breach Watch Archive)

Staffordshire County Council

Posted on by

What
Breach of the Data Protection Act

How much
Unknown.

Why
The data controller failed to respond to an individual’s subject access request in the prescribed period of 40 days.

Regulator
ICO

Regulatory action
Enforcement Notice issued, requiring the data controller to supply the individual with a copy of a document within 35 days of the Notice being issued.

Reason for action
The data controller failed to inform the individual, without undue delay, whether personal data relating to him was being processed by it or on its behalf.

When
7 February 2012

Links
View PDF of the Staffordshire County Council Enforcement Notice (Via ICO Website)

View PDF of the Staffordshire County Council Enforcement Notice (Breach Watch Archive)

Powys County Council

Posted on by

Breach details

What Disclosure of sensitive personal information.
How much 19 records.
When 4 February 2011
Why A member of the public received a children protection report on an unrelated child along with a document concerning her own child due to an employee of the data controller accidentally mixed in another colleague’s work when collecting printing from a shared printer. Although the Data Controller had said that they considered Data Protection training vital they had not made the completion of such training mandatory. This was the second of such incidents.

Regulatory action

Regulator ICO
Action Monetary penalty of £ 130,000
Enforcement Notice Issued to ensure that by 31 March 2012 all staff with access to personal data must undergo full data protection training and that an accurate record must be kept of this training
When 6 December 2011

Why the regulator acted

Breach of act Data sent to an incorrect recipient.
Inappropriate organisational and technical measures.
Known or should have known Following the previous breach the risk was clear, but insufficient measures were taken to prevent this second breach.
Likely to cause damage or distress Data related to a child and has the potential for misuse.

Links

View PDF of the Powys County Council Monetary Penalty Notice (Breach Watch Archive)
View PDF of the Powys County Council Monetary Penalty Notice (Via ICO Website)
View PDF of the Powys County Council Enforcement Notice (Breach Watch Archive)
View PDF of the Powys County Council Enforcement Notice (Via ICO Website)

Direct Response Security Systems

Posted on by

What

Breach of the Privacy and Electronic Communications Act

How much

–

Why

Making of unsolicited marketing calls.

Regulator

ICO

Regulatory action

Enforcement notice issued to ensure that the numbers of any subscribers who have declared that they do not wish to receive marketing calls are suppressed and that a line data is checked against the TPS list every 28 days.

Reason for action

Each of the individuals who complained about the calls from Direct Response Security Systems Limited had already stated that they did not wish to receive such calls, yet continued to receive them.

When

19 August 2010

Links

View the Direct Response Security Systems Enforcement Notice (Via ICO Website)