Glasgow City Council has been fined £150,000 for a data security offence. The Information Commissioner’s Office (ICO) has issued the fine for the loss of two unencrypted laptops, one of which contained the personal information of 20,143 people.
What the data protection regulator termed a serious breach of the Data Protection Act came after the council was previously issued with an enforcement notice three years ago, following a similar breach where an unencrypted memory stick containing personal data was lost.
In the latest incident, two unencrypted laptops were stolen from the council’s offices in May 2012. The laptops were stolen from premises which were being refurbished and where complaints of theft and a lack of security had been made. One laptop had been locked in its storage drawer and the key placed in the drawer where the second laptop was kept, but the second drawer was left unlocked overnight, allowing the thief access to both laptops.
One of the laptops stolen contained the council’s creditor payment history file, listing the personal information of over 20,000 people, including 6,069 individuals’ bank account details.
The ICO found that, despite the regulator’s previous warning and in breach of its own policy, the council had issued a number of its staff with unencrypted laptops, after encountering problems with the encryption software. While most of these devices were later encrypted, the ICO also discovered that a further 74 unencrypted laptops remain unaccounted for, with at least six of these known to have been stolen.
Ken Macdonald, the ICO’s Assistant Commissioner for Scotland said: “Glasgow City Council was issued with an enforcement notice back in 2010 after a similar incident where an unencrypted memory stick was lost. To find out that these poor practices have returned some two years later shows a flagrant disregard for the law and the people of Glasgow. The council should be held to account, and the penalty goes some way to achieving that.”
The ICO has also served the council with an enforcement notice requiring it to carry out a full audit of its IT assets used to process personal data and arrange for all of its managers to receive asset management training. The council must also carry out a full check of all of its devices each year so that the asset register can be kept up to date.
The ICO has produced guidance on the use of encryption software which is available on the ICO website.
