ICO fines Heathrow over USB stick fiasco

Airport hit with £120,000 penalty for failing to secure personal data within its network

USB stick next to keyboard

Heathrow Airport has been accused of a "catalogue of shortcomings" and fined 120,000 by the ICO over data protection failings.

The ICO began an investigation into the airport after a member of the public found a USB stick which had been lost by a Heathrow employee in October last year.

The stick, which contained 76 folders and more than 1,000 files, was neither encrypted nor password protected, which allowed the member of the public to view its contents at a local library.

"Data Protection should have been high on Heathrow's agenda," said the ICO's director of investigations, Steve Eckersley. "But our investigation found a catalogue of shortcomings in corporate standards, training and vision that indicated otherwise.

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

"Data protection is a boardroom issue and it is imperative that businesses have the policies, procedures and training in place to minimise any vulnerabilities of the personal information that has been entrusted to them."

Although the amount of sensitive and personal data held on the stick comprised a small amount of the total files, the ICO said it was concerned about a training video, which exposed the details of 10 individuals. The information included their names, dates of birth, passport numbers and the details of up to 50 other Heathrow aviation security personnel.

The leak became public knowledge when the stick was passed to a national newspaper, which took copies of the data before giving the stick back to Heathrow Airport Ltd (HAL). A number of standard remedial actions were taken by HAL once it was informed of the breach, such as reporting the matter to the police and engaging a third-party specialist to monitor the internet and the dark web.

However, the ICO's investigation found further evidence that HAL's staff were not up to scratch with just two percent of the 6,500-strong workforce having received data protection training.

Other concerns noted during the investigation included the widespread use of removable media in contradiction of HAL's own policies and guidance, as well as ineffective controls preventing personal data from being downloaded onto unauthorised or unencrypted media.

Featured Resources

The essential guide to cloud-based backup and disaster recovery

Support business continuity by building a holistic emergency plan

Download now

Trends in modern data protection

A comprehensive view of the data protection landscape

Download now

How do vulnerabilities get into software?

90% of security incidents result from exploits against defects in software

Download now

Delivering the future of work - now

The CIO’s guide to building the unified digital workspace for today’s hybrid and multi-cloud strategies.

Download now
Advertisement

Most Popular

Visit/cloud/microsoft-azure/354230/microsoft-not-amazon-is-going-to-win-the-cloud-wars
Microsoft Azure

Microsoft, not Amazon, is going to win the cloud wars

30 Nov 2019
Visit/cloud/amazon-web-services-aws/354223/what-to-expect-from-aws-reinvent-2019
Amazon Web Services (AWS)

What to expect from AWS Re:Invent 2019

29 Nov 2019
Visit/hardware/354232/raspberry-pi-4-owners-complain-of-broken-wi-fi-when-using-hdmi
Hardware

Raspberry Pi 4 owners complain of broken Wi-Fi when using HDMI

29 Nov 2019
Visit/mobile/google-android/354189/samsung-galaxy-a90-5g-review-simply-the-best-value-5g-phone
Google Android

Samsung Galaxy A90 5G review: Simply the best value 5G phone

22 Nov 2019