Repair Management Services of Blackburn has promised the
Information Commissioner's Office (ICO) that it will improve its
data security and that it will encrypt laptops or any other
machines which carry personal data no later than next March.
Repair Management Services, which used to be known as MVRA, is a
trade association representing car repair companies.
A laptop containing personal details on 36,800 people and
information about 1,900 driving convictions was left in a car in a
car park. The car was broken into and the laptop, which was
protected by a password but not encryption, was stolen.
"Personal information is valuable," said Sally-anne Poole, head
of enforcement and investigations at the ICO. “In this case, it
also involved the details of criminal convictions which, if
accessed, could potentially result in distress being caused to the
individuals concerned."
The trade body has made a written undertaking to the ICO
committing it to encrypting machines and to training staff in its
information policies and procedures to try to ensure that such an
incident is not repeated.
"The data controller did not ensure sufficient security measures
were in place to prevent the unauthorised or unlawful processing of
the data in question," said the ICO in the undertaking. "In
particular the computer held data which was not protected by a
minimum standard of encryption. The Commissioner has taken into
account the fact that a proportion of the personal data in question
related to criminal convictions and could therefore potentially
result in distress being caused to the individuals concerned."
Because of the body's undertaking the Information Commissioner
has decided not to serve an Enforcement Notice on it under the Data
Protection Act in relation to a breach of the Act. It says that
organisations should take "appropriate technical and organisational
security measures" to prevent the leaking of personal data.
"I welcome the steps being taken by Repair Management Services
Ltd and urge all organisations to implement the appropriate
safeguards and training to prevent personal information falling
into the wrong hands," said Poole.
Disclaimer: We hope you find OUT-LAW’s content useful. It’s prepared by the lawyers at Pinsent Masons. Please remember, though, that it’s intended as general information only. It’s not legal advice. If that’s what you’re seeking, please
contact us. See also: our
full disclaimer
