A university breached the Data Protection Act after disclosing personal information in training materials published on its website, the Information Commissioner’s Office (ICO) said. The personal data was contained in screenshots used to demonstrate the use of particular University of Durham systems and included details such as names, addresses and dates of birth of up to 177 former students and staff. The information – which had not been anonymised – was made available on the University’s website in February 2011. The university discovered the error in July 2011 and removed the material before reporting the matter to the ICO.
The ICO’s investigation also uncovered that only around 20pc of the University’s non-manual staff had accessed the online training materials available to them. One to one training was only provided for a limited number of staff who were then responsible for disseminating their learning to colleagues. The University undertook no monitoring to confirm if this was done or, if it was, whether the information was conveyed correctly.
The uni has now committed to ensuring that all staff receive appropriate training on how to follow the organisation’s data protection guidance. It will also make sure that documents containing personal data will not be published on the university’s website.
Steve Eckersley, Head of Enforcement at the ICO said: “All documents should be checked for personal information before being made available on a website. This case also highlights the importance of organisations having comprehensive data protection training in place for all staff. It is vital that schools, colleges and universities introduce robust systems to handle their pupils’ information on electronic and paper based systems in compliance with the Data Protection Act and we will continue to work with those in the education sector to ensure they are keeping young peoples’ details secure.”
