Employees warned against holding on to sensitive data when quitting a job

ICO says it will take a tough stance against those found in breach of Data Protection Act 2018

Image of a worker inserting or removing a USB drive from a laptop

The Information Commissioner's Office (ICO) has sounded a warning to employees who deliberately retain "historical personal data" after moving on from their positions.

Under the Data Protection Act 2018, which closely mirrors the EU's General Data Protection Regulations (GDPR), workers who "knowingly or recklessly" hold onto personal data may face regulatory action.

Advertisement - Article continues below

Although general in scope, this reminder concerns individuals whose roles involve gathering and handling personal data belonging to clients, customers, or others, either electronically or in paper form. Violations would occur when workers make unnecessary copies of personal data after collection, as well as when they leave their positions and keep this information.

The warning comes after the UK's data watchdog decided, following legal consultation, not to take enforcement action against two police officers who had been interviewed by the media about a historic case they'd worked on involving an MP.

The two Met Police officers were investigated by the ICO under the previous legislation, the Data Protection Act 1998, after disclosing details about the case to the media. This was adjudicated under the previous legislation because the initial violation occurred prior to the GDPR coming into force on 25 May 2018.

The older act was updated to add in a tougher provision that made it unlawful to "knowingly or recklessly" hold onto personal data without the consent of whoever was the data controller at the moment the data was collected.

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

After legal consultation, the regulator decided not to take enforcement action, but warned that fresh provisions under the Data Protection Act 2018 mean that employees can face regulatory action if they were found to have retained information collected as part of their employment.

There are exceptions to this, however, which principally involve retaining personal data in instances where it's necessary to prevent crime, authorised by a court order, or in the public interest.

Although the ICO decided not to proceed with regulatory action against the police officers in this instance, the regulator has indeed taken action in similar cases through the years against instances of employees misusing personal data.

For example, the regulator prosecuted a charity worker in 2017 for making his own copies of sensitive data and emailed them to his personal email address without knowledge of the data controller, Rochdale Connections Trust.

The worker sent 11 emails from his work email account in February 2017 which contained sensitive personal information of 183 people, including three children.

Advertisement - Article continues below

An education worker, meanwhile, was fined 850 and ordered by pay 713 in costs last year after illegally sharing personal data about children and their parents.

The former Southwark Council schools admission department apprentice was found guilty of screenshotting a spreadsheet containing information about children and their eligibility for free school meals before sending it to a parent via Snapchat.

Featured Resources

Preparing for long-term remote working after COVID-19

Learn how to safely and securely enable your remote workforce

Download now

Cloud vs on-premise storage: What’s right for you?

Key considerations driving document storage decisions for businesses

Download now

Staying ahead of the game in the world of data

Create successful marketing campaigns by understanding your customers better

Download now

Transforming productivity

Solutions that facilitate work at full speed

Download now
Advertisement

Recommended

Visit/policy-legislation/general-data-protection-regulation-gdpr/355337/ico-will-reduce-gdpr-fines-due-to
General Data Protection Regulation (GDPR)

ICO to relax GDPR enforcement during coronavirus economic downturn

16 Apr 2020
Visit/security/privacy/355304/nhs-working-with-apple-google-coronavirus-tracking-app
privacy

The NHS teams up with Apple and Google on coronavirus tracking app

14 Apr 2020
Visit/policy-legislation/data-protection/355250/health-sites-sharing-users-medical-data-with-major-tech
data protection

Health sites are 'unlawfully' sharing medical data with Facebook and Google

7 Apr 2020
Visit/policy-legislation/data-protection/355184/supreme-court-finds-morrisons-was-not-liable-for-2014
data protection

Supreme Court rules Morrisons was not liable for 2014 data breach

1 Apr 2020

Most Popular

Visit/laptops/29190/how-to-find-ram-speed-size-and-type
Laptops

How to find RAM speed, size and type

24 Jun 2020
Visit/mobile/google-android/356373/over-2-dozen-additional-android-apps-found-stealing-user-data
Google Android

Over two dozen Android apps found stealing user data

7 Jul 2020
Visit/cloud/356260/the-road-to-recovery
Sponsored

The road to recovery

30 Jun 2020