Data and securityCyber SecurityLondon Council fined after personal information put at risk

London Council fined after personal information put at risk

Islington Council failed to keep up to 89,000 people’s information secure on its parking ticket system website

Islington Council failed to keep up to 89,000 people’s information secure on its parking ticket system website, according to an Information Commissioner’s Office (ICO) investigation which has resulted in a £70,000 fine for the London borough.

Islington Council’s Ticket Viewer system allows people to see a CCTV image or video of their alleged parking offence. It was found to have design faults meaning the personal data of up to 89,000 people was at risk of being accessed by others. That data included a small amount of sensitive personal information such as medical details relating to appeals.

The problem came to light in October 2015 when Islington Council was informed by a member of the public using the system that folders containing personal data could be accessed by manipulating the URL.

It was discovered that there had been unauthorised access to 119 documents on the system 235 times from 36 unique IP addresses, affecting 71 people.

Sally Anne Poole, ICO Enforcement Manager, said: “People have a right to expect their personal information is looked after. Islington Council broke the law when it failed to do that.

“Local authorities handle lots of personal information, much of which is sensitive. If that information isn’t kept secure it can have distressing consequences for all those involved. It’s therefore vital that all council staff take data protection seriously.”

The ICO found that the council should have tested the system both prior to going live and regularly after that.

In failing to do so, the London borough failed to take the appropriate technical measures to keep personal information secure. This was a breach of the Data Protection Act.

Data protection laws are set to get tougher and councils have work to do to get ready. Earlier this year the ICO published the results of its local government survey, which showed many authorities were not yet prepared for the new General Data Protection Regulation.

The GDPR, which applies from May 2018, requires a privacy impact assessment is carried out in certain circumstances when using new technologies and the processing is likely to result in a high risk to the rights and freedoms of individuals.

The ICO has website pages dedicated to helping organisations prepare for data protection law reform.

Related Articles

Q&A: How cyber security is changing in the public sector

Cyber Security Q&A: How cyber security is changing in the public sector

1w Austin Clark
NCSC defends UK from more than 10 cyber attacks a week

Cyber Security NCSC defends UK from more than 10 cyber attacks a week

1m Austin Clark
GDS clarifies private sector access to GOV.UK Verify

Cyber Security GDS clarifies private sector access to GOV.UK Verify

1m Austin Clark
Is automation essential in the cyber security battle?

Cyber Security Is automation essential in the cyber security battle?

2m Austin Clark
Please mind the security gap between the premises and the cloud

Cloud Computing Please mind the security gap between the premises and the cloud

2m Guest Writer
NHS trusts not discouraging WhatsApp, Facebook Messenger and other consumer apps

Cyber Security NHS trusts not discouraging WhatsApp, Facebook Messenger and other consumer apps

3m Austin Clark
Best form of defence: Is the Government's cyber strategy on the right track?

Cyber Security Best form of defence: Is the Government's cyber strategy on the right track?

3m Guest Writer
Making the cloud a safe space

Cloud Computing Making the cloud a safe space

3m Guest Writer