The personal details of thousands of London housing tenants were discovered on an unencrypted memory stick left in a pub, according to the Information Commissioner’s Office (ICO), which has blasted the two housing bodies for breaching the Data Protection Act.
The memory stick belonged to a contractor who was carrying out work for Lewisham Homes and had previously also worked for Wandle Housing Association.
The contractor had copied the information held on the memory stick from both organisations’ networks. The device contained details of over 20,000 tenants of Lewisham Homes and 6,200 tenants of Wandle Housing Association. Nearly 800 of the records belonging to Lewisham Homes also contained tenants’ bank account details.
Both organisations have agreed to make sure that all portable devices used to store personal information are encrypted. All staff, including contractors, must follow existing policies and procedures on the handling of personal information. All staff, including contractors and temporary staff, will also be monitored to ensure they are taking the appropriate measures to keep the personal information they are handling secure.
ICO acting head of enforcement Sally-Anne Poole said: “Saving personal information on to an unencrypted memory stick is as risky as taking hard copy papers out of the office. Luckily, the device was handed in and there is no suggestion that the data was misused. But this incident could so easily have been avoided if the information had been properly protected.”
