The Information Commissioner’s Office (ICO) has served a £70,000 penalty to Lancashire Constabulary after papers containing sensitive information about a 15 year old girl were found on a street in Blackpool. This is the first penalty the ICO has issued to a police force.
In an almost comical turn of events, it is said that the missing person’s report was left in the car of an officer who was trying to track down the individual in question. The report then – somehow –managed to find its way out of the car, the ICO use the term ‘…the report fell out of the car’. Perhaps it was its turn on tea run.
The report was found by a member of the public and handed in to a local newspaper. The report contained extremely sensitive information of about the girl including her name, age, address, the fact that she had been raped, the girls’ attacker, and details of 14 other people.
There are many issues at play here…
One: would Lancashire Constabulary even have noticed if the report was not found and handed in?
Two: Did the Constabulary have any process for reporting the loss/theft of documents, and thus a plan of action in such an event (yes, this is a rhetorical question as they blatantly did not).
Three: How many other instances of careless and mishandling of sensitive information go on up and down the county in our Constabulary’s?
The Information Commissioner slapped a £70,000 fine on Lancashire Police and they have agreed to an undertaking of their data handling procedures. Considering the nature of the data loss, and the sensitivity of the information, Lancashire Police might well feel they’re lucky not to have incurred a larger fine.
Steve Eckersley, Head of Enforcement said of the issue:
“The fact that information as sensitive as this could go missing without anybody realising is extremely worrying, and shows that Lancashire Constabulary failed to have the necessary governance, policies and suitable training in place to keep the personal information they handle secure.”
“The loss of this information and the news that it had been leaked to a local newspaper is likely to have been extremely distressing for all involved.”
Complying with the data protection act and ensuring you handle data correctly isn’t that difficult, especially when someone else has already thought of the solution for you.
|Complete Data Protection Toolkit