26th September 2013
A small trader in London has been fined £5,000 by the Information Commissioner’s Office (ICO) after the loss of a hard drive containing financial details relating to all of its customers. The incident serves as a reminder that it is not only large organisations who are at risk of contravening data protection regulations.
Wembley-based sole trader Jala Transport Ltd, a loans company, lost the drive after it was stolen from the business owner’s car while it was stationary at traffic lights in London in August last year. In a case with some documents and cash, the drive was password protected but not encrypted. It included details of the names of the company's 250 customers together with their date of birth, address, the identity documents used to support the loan application and details of the payments made.
The ICO expects all information to be encrypted where the loss of the data could lead to those affected suffering damage and distress. A penalty of £70,000 could have been levied, but was reduced to £5,000 owing to the company's limited financial resources. The fact that the company voluntarily reported the breach was also taken into consideration.
The regulator warned small businesses that they must make sure they have adequate measures in place to keep customers’ details secure, after a sole trader was fined £5,000. Head of Enforcement Stephen Eckersley, said: “We have continued to warn organisations of all sizes that they must encrypt any personal data stored on portable devices, where the loss of the information could cause clear damage and distress to the customers affected. While the circumstances of this case are unfortunate, if the hard drive had been encrypted the business owner would not have left all of their customers open to the threat of identity theft and would not be facing a £5,000 penalty following a serious breach of the Data Protection Act."
