ICO Fines North East Lincolnshire Council £80,000 For Lost USB Stick

The Information Commissioner’s Office (ICO) has fined the North East Lincolnshire Council £80,000, two years after a teacher lost a memory stick with information about hundreds of children with special educational needs.

The investigation found that data on the stick wasn’t encrypted, even though the Council introduced a policy which required its employees to encrypt all portable devices in April 2011. In addition, ICO couldn’t establish whether the teacher received data protection training prior to the incident.

Unencrypted

According to the ICO,  the memory stick with information about 286 local children was left in a laptop at the council’s offices in July 2011. But when its owner, a special educational needs teacher, returned, the device was gone.

The misplaced data included dates of birth, a list of mental and physical health problems and teaching requirements. Some files also featured home addresses and information about students’ home life.

“Organisations must recognise that sensitive personal data stored on laptops, memory sticks and other portable devices must be encrypted,” said Stephen Eckersley, head of enforcement at ICO. “North East Lincolnshire Council failed to do this by delaying the introduction of a policy on encryption for two years and then failing to make sure that staff were following the policy once it was finally implemented.

“This breach should act as a warning to all organisations that their data protection policies must work in practice, otherwise they are meaningless and fail to ensure people’s information is being looked after correctly.”

Over the last two years, ICO has published extensive guidelines on data protection in schools, including advice on encryption, photography, CCTV recording, information sharing and correct disposal of digital equipment.

Can you look after your personal data online? Take our quiz!