ICO slams Cambridgeshire County Council after USB stick loss

The USB stick, which contained sensitive data relating to six vulnerable adults, was lost last year, and the council informed the ICO about the problem last November.

According to the ICO, the information included case notes and minutes of meetings relating to the individuals' support and was saved on an unapproved - and unencrypted - memory stick.

The device was used to store the information after the member of staff encountered problems using an encrypted memory stick that the council had previously provided free of charge.

The breach of the DPA occurred shortly after the council had undertaken an internal campaign aimed at promoting its encryption policy.

During this time, the ICO says that employees had been asked to hand in unencrypted devices and were warned about the importance of keeping personal information secure.

Sally Anne-Poole, enforcement group manager with the ICO, said that, whilst Cambridgeshire County Council clearly recognise the importance of encrypting devices in order to keep personal data secure, this case shows that organisations need to check their data protection policies are continually followed and fully understood by staff.

Mark Lloyd, chief executive of the council, has signed a formal undertaking to ensure that all portable devices used by the council are encrypted using encryption software that meets the current standard.

The council has also agreed to carry out regular monitoring of its data protection policies and IT security measures in order to ensure that they are being followed by all staff.

No financial penalties have been levied against the council.

What’s hot on Infosecurity Magazine?