ICO raps housing bodies after details of 26k+ tenants left in pub

The details of more than 26,000 tenants of two housing bodies – including their bank accounts in some cases – were found on an unencrypted memory stick in a London pub, an Information Commissioner’s Office investigation has revealed.

The memory stick, which was handed in to the police and retrieved at a later date, was left by a contractor who worked for Lewisham Homes and had previously worked for Wandle Housing Association (WHA).

It contained information on more than 20,000 tenants of Lewisham Homes and 6,200 tenants of WHA. Almost 800 of the Lewisham Homes’ records also included the tenants’ bank account details. The contractor had copied the information from the bodies’ networks.

Following the breach of the Data Protection Act, the two organisations have given an undertaking that they will ensure all portable devices used to store personal information are encrypted.

They will also require all staff – including contractors – to follow existing policies and procedures on the handling of personal information. Lewisham Homes and WHA will also monitor employees, contractors and temporary staff to ensure compliance.

Sally-Anne Poole, Acting Head of Enforcement at the ICO, said: “Saving personal information on to an unencrypted memory stick is as risky as taking hard copy papers out of the office. Luckily, the device was handed in and there is no suggestion that the data was misused. But this incident could so easily have been avoided if the information had been properly protected.”