Education bodies caught in data breach gaffes

gallery

Two educational institutions have been caught breaking the Data Protection Act after failing to protect laptops that were later stolen.

In the case of the Association of School and College Leaders (ASCL) a laptop containing sensitive personal data was stolen from an employee’s home in Yorkshire.

Whilst the laptop itself was encrypted, certain files were not, meaning data relating to around 100 individuals was not protected. In some cases, details of people’s physical or mental health were easily accessible to whoever stole the laptop.

Holly Park School in Barnet had an unencrypted laptop stolen from an unlocked office. Lost data included pupils’ names, addresses, exam marks and information relating to their health.

This type of breach is inexcusable and is putting people’s personal information at risk unnecessarily.

On carrying out an investigation, the Information Commissioner’s Office (ICO) discovered the school did not have a data protection policy in place.

“The ICO’s guidance is clear: all personal information – the loss of which is liable to cause individuals damage and distress - must be encrypted,” said Sally Anne Poole, the watchdog’s acting head of enforcement.

“This is one of the most basic security measures and is not expensive to put in place - yet we continue to see incidents being reported to us. This type of breach is inexcusable and is putting people’s personal information at risk unnecessarily.”

As is typical with ICO investigations, both organisations have agreed to improve their data protection practices. No fines were handed out.

The ICO has not issued a fine since June, when it hit Surrey County Council with a £120,000 fine.

Email to a friend

Print this page