How much

“Several”

Why

A rucksack contained hard copy documentation relating to several individuals was stolen from a keyworker’s car. A second incident was also reported during when an email was sent in error to several hundred people containing a full occupational health form for one player.

Regulator

ICO

Regulatory action

Undertaking issued to ensure that hard copy documentation is only removed from the office or secure storage when absolutely necessary and must contain the minimum amount of personal data required. Thorough risk assessments are to be completed for all mobile working arrangements.

Reason for action

• In the case of the first incident it was discovered that the carrying significantly more paperwork than necessary without the knowledge of management. Investigations revealed that despite the fact that many employees are predominantly mobile workers the implications of how to handle data in a mobile environment had been insufficiently considered. Employees had however received appropriate training relating to the removal of personal data from the office.
• In the second incident it transpired that autofill is often used when sending emails and that existing email groups do not differentiate between internal and external addresses.

When

10 February 2012.

Links

View PDF of the Bolton Council Undertaking (Via ICO Website)

View PDF of the Bolton Council Undertaking (Breach Watch Archive)