The UK’s independent authority set up to uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals.

Thousands of tenants’ details found on memory stick left in a London pub

Subscribe to our latest news

News release: 4 August 2011


Two London housing bodies breached the Data Protection Act after details relating to thousands of their tenants were discovered on an unencrypted memory stick left in a pub, the Information Commissioner’s Office (ICO) said today. The memory stick was handed in to the police and safely retrieved at a later date.

The memory stick belonged to a contractor who was carrying out work for Lewisham Homes and had previously also worked for Wandle Housing Association. The contractor had copied the information held on the memory stick from both organisations’ networks. The device contained details of over 20,000 tenants of Lewisham Homes and 6,200 tenants of Wandle Housing Association. Nearly 800 of the records belonging to Lewisham Homes also contained tenants’ bank account details.

Both organisations have agreed to make sure that all portable devices used to store personal information are encrypted. All staff, including contractors, must follow existing policies and procedures on the handling of personal information. All staff, including contractors and temporary staff, will also be monitored to ensure they are taking the appropriate measures to keep the personal information they are handling secure.

Sally-Anne Poole, Acting Head of Enforcement at the ICO, said:

“Saving personal information on to an unencrypted memory stick is as risky as taking hard copy papers out of the office. Luckily, the device was handed in and there is no suggestion that the data was misused. But this incident could so easily have been avoided if the information had been properly protected. 

“We are pleased that Lewisham Homes and Wandle Housing Association will now make sure that all contractors follow their guidance on keeping personal information secure.”

View all of our data protection undertakings here 

 

Notes to Editors

  • The Information Commissioner’s Office (ICO) upholds information rights in the public interest, promoting openness by public bodies and data privacy for individuals.
  • The ICO has specific responsibilities set out in the Data Protection Act 1998, the Freedom of Information Act 2000, Environmental Information Regulations 2004 and Privacy and Electronic Communications Regulations 2003.
  • The ICO is on Twitter, Facebook and LinkedIn, and produces a monthly e-newsletter.
  • Contact our press office on 0303 123 9070 and at ico.gov.uk/press