The Information Commissioner's Office (ICO) has found Skipton Financial Services Limited (SFS) in breach of the Data Protection Act 1988 (DPA) in relation to the theft of an unencrypted laptop containing the personal information, including names, dates of birth, national insurance numbers and investment amounts, of around 14,000 SFS customers. The laptop was stolen from a company providing software consultancy services to SFS. The ICO found that SFS was in breach of the seventh data protection principle in the DPA, which requires appropriate technical and organisational measures to be taken to prevent unauthorised or unlawful processing of personal data and accidental loss or destruction of, or damage to, personal data. The ICO has obtained an undertaking from SFS that it will ensure that personal data held on laptops either by SFS or by its contractors is fully encrypted and that it will carry out a risk assessment before engaging third parties to process data on its behalf. It is notable that the undertaking is more specific as to the processing of data by third parties than the enforcement notice issued by the ICO against Marks & Spencer in relation to a similar breach of the DPA.
Source: ICO press release and undertaking, 20 February 2008.
Source: ICO press release and undertaking, 20 February 2008.
