From the Information Commissioner’s Office:
Two London housing bodies breached the Data Protection Act after details relating to thousands of their tenants were discovered on an unencrypted memory stick left in a pub, the Information Commissioner’s Office (ICO) said today. The memory stick was handed in to the police and safely retrieved at a later date.
The memory stick belonged to a contractor who was carrying out work for Lewisham Homes and had previously also worked for Wandle Housing Association. The contractor had copied the information held on the memory stick from both organisations’ networks. The device contained details of over 20,000 tenants of Lewisham Homes and 6,200 tenants of Wandle Housing Association. Nearly 800 of the records belonging to Lewisham Homes also contained tenants’ bank account details.
Both organisations have agreed to make sure that all portable devices used to store personal information are encrypted. All staff, including contractors, must follow existing policies and procedures on the handling of personal information. All staff, including contractors and temporary staff, will also be monitored to ensure they are taking the appropriate measures to keep the personal information they are handling secure.
Sally-Anne Poole, Acting Head of Enforcement at the ICO, said:
“Saving personal information on to an unencrypted memory stick is as risky as taking hard copy papers out of the office. Luckily, the device was handed in and there is no suggestion that the data was misused. But this incident could so easily have been avoided if the information had been properly protected.
“We are pleased that Lewisham Homes and Wandle Housing Association will now make sure that all contractors follow their guidance on keeping personal information secure.”
So why wasn’t the contractor named? Even if the entities are ultimately responsible, shielding the names of contractors makes no sense to me and removes what could be a deterrent.