Category Archives: Local Government

Oldham Council

Posted on by

What
Loss of sensitive personal data.

How much
220 records.

Why
13 unencrypted laptops were stolen during a burglary at secure council offices, with the exception of one stolen from a staff members car and another that was stolen during the course of a youth activity evening.

Regulator
ICO

Regulatory action
Undertaking issued to ensure that all mobile data storage devices are sufficiently encrypted. All staff must be made aware of the data controller’s policy for the storage of personal data and be trained to follow it.

Reason for action
Three of these unencrypted laptops held sensitive personal data and the council did not take adequate steps to safeguard the data, either through encryption, or better physical security in respect of the two laptops stolen outside of council property.

When
7 July 2009

Links
View PDF of the Oldham Council Undertaking (Breach Watch Archive)

Sandwell Metropolitan Borough Council

Posted on by

What
Loss of sensitive personal data.

How much
About four records.

Why
An unencrypted memory stick containing data relating to children in care was lost.

Regulator
ICO

Regulatory action
Undertaking issued to ensure that all portable media devices are encrypted to a suitable standard. Staff must be made aware of the data controller’s policy for the storage and use of personal data and be appropriately trained to follow that policy.

Reason for action
Sensitive data was transferred to the memory stick in breach of Council procedure and was not password protected. The employee intended to use the data to work at home, but lost it during his commute.

When
29 July 2009

Links
View PDF of the Sandwell Metropolitan Borough Council Undertaking (Breach Watch Archive)

Manchester City Council

Posted on by

What
Loss of personal data.

How much
1,754 records.

Why
Two unencrypted laptops were stolen from the internal audit offices in the Town Hall.

Regulator
ICO

Regulatory action
Undertaking issued to ensure that appropriate security measures are in place to ensure that laptops are safely stored and encrypted. Only personal data absolutely necessary for audit purposes may be downloaded to mobile devices  All staff must be made aware of the data controller’s policy for the storage of personal data and be trained to follow it.

Reason for action
The laptops were not encrypted, password protected, or secured to immovable objects, in breach of a number of the data controllers’s internal policies and procedures, in which all staff had received training.

When
16 June 2009

Links
View PDF of the Manchester City Council Undertaking (Breach Watch Archive)

The Highland Council

Posted on by

What
Loss of sensitive personal data.

How much
1,400 records.

Why
Two unencrypted laptops were stolen from a locked office on the data controller’s premises.

Regulator
ICO

Regulatory action
Undertaking issued to ensure that appropriate security measures are in place to ensure that laptops are safely stored and encrypted.

Reason for action
The laptops were not encrypted and no additional physical security measures were in place beyond being placed in a locked office.

When
2 June 2009

Links
View PDF of the Highland Council Undertaking (Breach Watch Archive)

Leicester City Council

Posted on by

What
Loss of sensitive personal data.

How much
About 80 records.

Why
An unencrypted USB memory stick containing data relating to about 80 children was lost.

Regulator
ICO

Regulatory action
Undertaking issued to ensure that all media storage devices must be sufficiently encrypted. Staff must be suitable trained in these internal policies and sufficient supervisory checks must be put into place to ensure adherence.

Reason for action
The storage of personal data on an unencrypted USB stick was contrary to council policies and procedures, which required all such devices to be purchasing centrally through its IT department and encrypted.

When
7 May 2009

Links
View PDF of the Leicester City Council Undertaking (Breach Watch Archive)

The British Council

Posted on by

What
Loss of sensitive personal data.

How much
22,000 records.

Why
An unencrypted computer data storage disc containing personal data relating to 2,000 staff, including trade union membership, was lost in transit by a courier service.

Regulator
ICO

Regulatory action
Undertaking issued to ensure that the data controller take all reasonable measures to ensure the physical security of personal data being processed either by the data controller or any third parties. Mobile media devices must be encrypted to a suitable standard. All staff must receive adequate data protection training.

Reason for action
Although the disc was lost by a third party, the council had failed to ensure that the disc was encrypted to a minimum standard.

When
7 April 2009

Links
View PDF of the British Council Undertaking (Breach Watch Archive)