Council narrowly escapes ICO fine after computer and papers found in skip

The London Borough of Southwark appears narrowly to have escaped a monetary penalty after misplacing a computer and papers containing personal information on 7,200 people.

The computer and papers were found in a skip earlier this year. They had been left at one of Southwark’s buildings when it was vacated in December 2009.

A new tenant of the building discovered the computer and papers in June and disposed of them.

According to the Information Commissioner’s Office, the information included details of peoples’ names and addresses, along with other information relating to their ethnic background, medical history and any past criminal convictions.

The watchdog’s investigation found that policies Southwark had in place about information handling and decommissioning were not followed. However, it also said the council had failed to make sure the information on the computer was encrypted.

The Acting Head of Enforcement at the Information Commissioner’s Office, Sally Poole, said: “The fact that thousands of residents’ personal details went missing for over two years clearly shows that Southwark Council’s policies for handling personal information are below standard. As this information was lost before the ICO received the power to issue financial penalties we are unable to consider taking more formal action in this case.”

Southwark has agreed to:

• introduce new processes governing the transfer and disposal of personal information
• ensure that all portable devices used to store sensitive information are fully protected
• undergo an ICO audit in 2012.

The ICO has also secured an undertaking from Central Essex Community Services after it lost a birth book containing information about the general health of 249 mothers and their babies.

The watchdog’s investigation found that the book – which has never been recovered – should have been stored in a locked filing cabinet. However, a lack of secured storage space meant it was stored on top of the cabinet in a locked room.

Central Essex Community Services has agreed to train staff on data protection and to monitor compliance with its guidance.