Southwark Council has become the latest public sector organisation to be hauled in front of the data watchdog after it inadvertently left behind the personal details of 7,200 people when it vacated a council building over two years ago.
The information – stored on a computer and in paperwork – included details of peoples’ names and addresses, along with other information relating to their ethnic background, medical history and any past criminal convictions.
The computer and papers were mistakenly left at one of the council’s buildings at the Spa Road Complex in Southwark when it was vacated in December 2009. They were then discovered in June of this year and disposed of by the building’s new tenant, which threw them in a skip.
The breach was reported to the Information Commissioner’s Office on June 3 2011 shortly after the data was discovered in the skip. The ICO’s enquiries found that, while the council did have information handling and decommissioning policies in place, the policies were not followed when the offices were vacated. The council also failed to make sure the information stored on the computer was encrypted.
The authority has now agreed to take action to keep the personal information it handles secure. This includes introducing new processes governing the transfer and disposal of personal information and making sure that all portable devices used to store sensitive information are fully protected.
The council has also agreed to an ICO audit in the new year to help them improve compliance with the Data Protection Act.
ICO acting head of enforcement Sally Anne Poole said: “The fact that thousands of residents’ personal details went missing for over two years clearly shows that Southwark Council’s policies for handling personal information are below standard. As this information was lost before the ICO received the power to issue financial penalties we are unable to consider taking more formal action in this case.
“Southwark Council has committed to putting changes in place and we look forward to completing an audit next year to help them to identify further improvements.”
In a separate move, a further undertaking has been signed by Central Essex Community Services after the loss of a birth book containing information about the general health of 249 mothers and their babies. The book – which should have been stored in a locked filing cabinet – was stored on top of the cabinet in a locked room due to no secure storage space being available. The book has never been recovered.
