The Information Commissioner’s Office (ICO) has levied a £70,000 ($90,000) fine against Islington Council after it failed to keep up to 89,000 people’s information secure on its Ticket Viewer system. Someone got in touch with the ICO to let it know that by manipulating a URL related to the Ticket Viewer website they were able to access a folder which contained personal data of people using the system.
Once it had been revealed that the data was accessible to anyone, the ICO discovered that there had been unauthorised access to 119 documents on the system 235 times from 36 unique IP addresses, affecting 71 people.
Sally Anne Poole, ICO Enforcement Manager, Said:
“People have a right to expect their personal information is looked after. Islington Council broke the law when it failed to do that.
Local authorities handle lots of personal information, much of which is sensitive. If that information isn’t kept secure it can have distressing consequences for all those involved. It’s therefore vital that all council staff take data protection seriously.”
The ICO said that the council had violated the Data Protection Act because it failed to take appropriate technical measures to keep personal information secure. It found that the council should have tested the system prior to, and after, its launch.
Source: ICO via The Register