The ICO has issued a £180,000 civil monetary penalty to The Money Shop after the company lost computer servers containing details of several thousand customers.
In two separate incidents reported to the regulator, one server was stolen from the company’s branch in Lurgan, Northern Ireland and a month later a second server was lost by a courier firm in Swindon.
Neither server had sufficient encryption systems for the company to be confident that the information they contained could not be accessed. The servers, which have still not been recovered, held large numbers of local and national customer records and employee details.
The company’s procedure was that servers should be stored in a separate locked room, but an ICO investigation found that the Lurgan store, and a significant number of other Money Shop branches, didn’t have separate rooms that could be used in this way. The company also had a widespread practice of regularly transporting unencrypted servers between its head office in Nottingham and its branches nationally and old customer records were not being deleted.
ICO’s Head of Enforcement, Steve Eckersley said:
“Customers of The Money Shop entrusted the company with their personal and financial details with the expectation that the information would be kept safely and securely. Our investigations discovered that this wasn’t the case and that this information was regularly left exposed when equipment was moved around the country. There was potential for fraud and financial loss to customers which is unacceptable and in both cases, had the data been properly encrypted the damage and distress to customers and the monetary penalty could have been avoided.
“Hopefully it’s an example to other organisations, whatever business they may be in, that the safety of personal information must be taken seriously. Policies and procedures must be put in place or we will take action.”
Notes to Editors
- The Information Commissioner’s Office upholds information rights in the public interest, promoting openness by public bodies and data privacy for individuals.
- The ICO has specific responsibilities set out in the Data Protection Act 1998, the Freedom of Information Act 2000, Environmental Information Regulations 2004 and Privacy and Electronic Communications Regulations 2003.
- The ICO is on Twitter, Facebook and LinkedIn. Read more in the ICO blog and e-newsletter.Our Press Office page provides more information for journalists.
- Anyone who processes personal information must comply with eight principles of the Data Protection Act, which make sure that personal information is:
- Fairly and lawfully processed
- Processed for limited purposes
- Adequate, relevant and not excessive
- Accurate and up to date
- Not kept for longer than is necessary
- Processed in line with your rights
- Not transferred to other countries without adequate protection
- Civil Monetary Penalties (CMPs) are subject to a right of appeal to the (First-tier Tribunal) General Regulatory Chamber against the imposition of the monetary penalty and/or the amount of the penalty specified in the monetary penalty notice.
- Any monetary penalty is paid into the Treasury’s Consolidated Fund and is not kept by the Information Commissioner’s Office (ICO).