The ICO has issued a formal reprimand to the Home Office, after sensitive documents were found at a public London venue.
The documents, which were handed by venue staff to police in September 2021, included two Extremism Analysis Unit Home Office reports and a Counter Terrorism Policing report. The reports contained personal data, including that of Metropolitan Police staff.
A government investigation concluded the Home Office was the most likely source of the documents. The reprimand has been issued to the Secretary of State for the Home Department (the Home Secretary), as the data controller for the Home Office.
The ICO found that the Home Office had failed to ensure an appropriate level of security of personal data, including where documents were classified as ‘Official Sensitive’. The investigation also found that the Home Office did not have a specific sign-out process for the removal of documents from the premises, and the incident was not reported to the ICO within the 72 hour time limit.
Information Commissioner John Edwards said:
“Government officials are expected to work with sensitive documents in order to run the country. There is an expectation, both in law and from the people the government serves, that this information will be treated respectfully and securely. In this instance that did not happen, and I expect the department to take steps to avoid similar mistakes in the future.”
The Home Office has since taken steps to avoid similar breaches occurring in the future. The reprimand sets out further actions needed, including a review of the handling instructions around ‘Official Sensitive’ information, consideration of a sign out process when documents leave the office, and a review of training provided to staff around the handling of records containing personal data.