Association rapped for losing tenant data
The information watchdog has taken action against a housing association that lost 57 files of data about its tenants.
The Information Commissioner’s Office found Orbit Heart of England to be in breach of the Data Protection Act, and the association has had to sign a formal undertaking to improve its processes.
The association lost the files, which contained sensitive personal information about individual tenants and their families, during an office move. It discovered the problem when it was contacted by an individual who had found some of the files in second-hand filing cabinets.
Orbit Heart of England has managed to recover 42 of the files, but 15 are still missing. The data contained in them includes information on ethnicity, and physical and mental health.
The ICO said Orbit took immediate steps to investigate the problem, reported the incident to its officers, and co-operated fully in the subsequent investigation. It noted that Orbit had no inventory of files, so did not know how many should be been received at the new office. Orbit has introduced a new office move procedure to address this.
Sally-Anne Poole, head of enforcement and investigations at the ICO, said: ‘These files included sensitive personal information which was compromised and it is concerning that 15 of these files are still missing.
‘I am pleased that the organisation reported the breach to us and has taken steps to ensure that data is now sufficiently protected, especially the enforcement of new procedures with regard to office moves.’
If Orbit does not comply with the terms of the undertaking it is likely to be subject to further enforcement action from the watchdog.
In a statement Orbit said: ‘OHE deeply regrets the breach of data security. We have used this incident as an opportunity to reassess our data security policies and procedures.
‘Our customers with whom we had contact expressed their disappointment but were satisfied that we had been open and honest and that the action we had taken and planned to take was appropriate.’