Council fined £70k by ICO over parking ticket system data breaches

A London borough has been hit with a £70,000 monetary penalty by the Information Commissioner’s Office after the authority failed to keep up to 89,000 people’s information secure on its parking ticket system website.

Islington Council’s Ticket Viewer system allows people to see a CCTV image or video of their alleged parking offence.

It was found to have design faults meaning the personal data of up to 89,000 people was at risk of being accessed by others, the watchdog said.

That data included a small amount of sensitive personal information such as medical details relating to appeals.

The problem came to light in October 2015 when the council was informed by a member of the public using the Ticketviewer website, developed by the council, that folders containing personal data could be accessed by manipulating the URL.

It was discovered that there had been unauthorised access to 119 documents on the system 235 times from 36 unique IP addresses, affecting 71 people.

The ICO concluded in the monetary penalty notice that the council should have tested the system both prior to going live and regularly after that.

In failing to do so, Islington had failed to take the appropriate technical measures to keep personal information secure. This was a breach of the Data Protection Act, the watchdog said.

Sally Anne Poole, ICO Enforcement Manager, said: “People have a right to expect their personal information is looked after. Islington Council broke the law when it failed to do that.

“Local authorities handle lots of personal information, much of which is sensitive. If that information isn’t kept secure it can have distressing consequences for all those involved. It’s therefore vital that all council staff take data protection seriously.”

Islington Council said that it accepted a fine imposed by the Information Commissioner’s Office (ICO) following a data breach in 2015 involving parking appeals and repeated its apology to those affected.

A spokesperson said: “We remain very sorry about the previous Ticketviewer problem and agree with the ICO that we failed to meet the required data protection standards back in 2015. As soon as we were aware of the problem we took every possible action to prevent a recurrence and instructed auditors to carry out a thorough review so we could learn from our mistake.”

The council has taken advantage of a reduction of the £70,000 fine for prompt payment, reducing the cost to £56,000.