14 DAY TRIAL // Rochdale Metropolitan Borough Council somehow managed to lose a memory stick that contained information on 18,000 of their residents.
The stick, which was lost in May, contained details such as names, addresses and payment info but fortunately, no bank account records were present. As it turns out, the USB storage device had been used by an officer from the institution's finance department to collate information required for final accounts.
The ICO began an investigation and found that the data protection practices were in breach with the Data Protection Act. While most of the info was of public interest and was already published online, the Commissioner's Office considered the council failed to provide data protection training for its staff.
“Storing the details of over 18,000 constituents on an unencrypted device is clearly unacceptable. This incident could have been easily avoided if adequate security measures had been in place. Luckily, the information stored on the device was not sensitive and much of it is publicly available. Therefore, the incident is unlikely to have caused substantial distress to local people,” said Acting Head of Enforcement, Sally Anne Poole.
“Our investigation uncovered a number of failings at Rochdale Metropolitan Borough Council – that’s why we will follow up with the council, to ensure they’re doing everything they can to prevent this type of incident happening again.”
This latest incident comes to prove that a data protection training is highly necessary for organizations that handle sensitive data. Fortunately, this time the chances of someone being exposed to identity fraud are slim, but the fact remains that such situations should not occur.
Hopefully, the council and other companies will learn from these events to make sure the information belonging to their customers is safe. As one of Intel's managers said not long ago, data protection is not that expensive and anyone could reach an understanding with their vendor on a favorable deal.