The ICO has issued a formal reprimand to the Home Office, after sensitive documents were found at a public London venue.
The documents, which were handed by venue staff to police in September 2021, included two Extremism Analysis Unit Home Office reports and a Counter Terrorism Policing report. The reports contained personal data, including that of Metropolitan Police staff.
A government investigation concluded the Home Office was the most likely source of the documents. The reprimand has been issued to the Secretary of State for the Home Department (the Home Secretary), as the data controller for the Home Office.
The ICO found that the Home Office had failed to ensure an appropriate level of security of personal data, including where documents were classified as ‘Official Sensitive’. The investigation also found that the Home Office did not have a specific sign-out process for the removal of documents from the premises, and the incident was not reported to the ICO within the 72 hour time limit.
Information Commissioner John Edwards said:
“Government officials are expected to work with sensitive documents in order to run the country. There is an expectation, both in law and from the people the government serves, that this information will be treated respectfully and securely. In this instance that did not happen, and I expect the department to take steps to avoid similar mistakes in the future.”
The Home Office has since taken steps to avoid similar breaches occurring in the future. The reprimand sets out further actions needed, including a review of the handling instructions around ‘Official Sensitive’ information, consideration of a sign out process when documents leave the office, and a review of training provided to staff around the handling of records containing personal data.
Notes to editors
- The Information Commissioner’s Office (ICO) is the UK’s independent regulator for data protection and information rights law, upholding information rights in the public interest, promoting openness by public bodies and data privacy for individuals.
- The ICO has specific responsibilities set out in the Data Protection Act 2018 (DPA2018), the United Kingdom General Data Protection Regulation (UK GDPR), the Freedom of Information Act 2000 (FOIA), Environmental Information Regulations 2004 (EIR), Privacy and Electronic Communications Regulations 2003 (PECR) and a further five acts and regulations.
- In June 2022, the Information Commissioner announced a trial that sees a greater use of his discretion to reduce the impact of fines on the public, where public authorities breach data protection law. In practice this means an increase in public reprimands and the use of wider powers, including enforcement notices, with fines only issued in the most egregious cases
- The ICO can take action to address and change the behaviour of organisations and individuals that collect, use and keep personal information. This includes criminal prosecution, non-criminal enforcement and audit.
- To report a concern to the ICO telephone our helpline 0303 123 1113 or go to ico.org.uk/concerns.