The ICO has hit Nottingham County Council with a 70,000 fine for failing to safeguard its citizens' data, which led to anyone being able to view the information online.
The problem was exposed when a member of the public was able to read the data online stored in the council's Home Care Allocation System (HCAS) following a Google search. Nottingham County Council didn't implement any kind of security to stop people being able to access files, such as a login.
The data, which is thought to have been accessible for over five years, held details on whether disabled and elderly people were in hospital and included the gender, addresses, postcodes and care requirements of the individuals. The concern was that criminals could access the data and use the information to break into peoples' homes while they were away.
"This was a serious and prolonged breach of the law. For no good reason, the council overlooked the need to put robust measures in place to protect people's personal information, despite having the financial and staffing resources available," ICO Head of Enforcement Steve Eckersley said.
"Given the sensitive nature of the personal data and the vulnerability of the people involved, this was totally unacceptable and inexcusable. Organisations need to understand that they have to treat the security of data as seriously as they take the security of their premises or their finances."
The breach was first reported in June 2016, when it contained a directory of 81 service users and the data of more than 3,000 people. Not included in the data was the patients' names, although the ICO said it would be easy enough for people to find this information out from other sources if they wanted to.
-
Manufacturers report millions in losses as downtime wreaks havoc on operationsNews UK manufacturers are losing up to £736 million every week due to downtime, according to new research, with outages lasting for several days on end.
-
Microsoft gives OpenAI restructuring plans the green lightNews The deal removes fundraising constraints and modifies Microsoft's rights to use OpenAI models and products
-
Scania admits leak of data after extortion attemptNews Hacker stole 34,000 files from a third-party managed website, trucking company says
-
23andMe 'failed to take basic steps' to safeguard customer dataNews The ICO has strong criticism for the way the genetic testing company responded to a 2023 breach.
-
AI recruitment tools are still a privacy nightmare – here's how the ICO plans to crack down on misuseNews The ICO has issued guidance for recruiters and AI developers after finding that many are mishandling data
-
“You must do better”: Information Commissioner John Edwards calls on firms to beef up support for data breach victimsNews Companies need to treat victims with swift, practical action, according to the ICO
-
LinkedIn backtracks on AI training rules after user backlashNews UK-based LinkedIn users will now get the same protections as those elsewhere in Europe
-
UK's data protection watchdog deepens cooperation with National Crime AgencyNews The two bodies want to improve the support given to organizations experiencing cyber attacks and ransomware recovery
-
ICO slams Electoral Commission over security failuresNews The Electoral Commission has been reprimanded for poor security practices, including a failure to install security updates and weak password policies
-
Disgruntled ex-employees are using ‘weaponized’ data subject access requests to pester firmsNews Some disgruntled staff are using DSARs as a means to pressure former employers into a financial settlement
