London councils fined £150,000 for unencrypted laptop thefts

Ealing and Hounslow councils have been hit with fines totaling 150,000 for the loss of unencrypted laptops containing personal details.

The Information Commissioner's Office (ICO) ruled, as a result of "serious breaches of the Data Protection Act," Ealing Council should pay 80,000, while Hounslow Council should cough up 70,000.

Both councils operate an out-of-hours service, which is overseen by Ealing Council and run by nine employees working remotely. Laptops are used to record data that comes in during that time.

Two of these laptops were stolen from an employee's home. Between them the laptops, which were password-protected but unencrypted, contained details on around 1,000 of Ealing Council's clients and data on around 700 of Hounslow Council's clients.

A statement from the ICO said that, as yet, there has been nothing to suggest that anyone has tried to access the data since the theft.

"Of the four monetary penalties that we have served so far, three concern the loss of unencrypted laptops. Where personal information is involved, password protection for portable devices is simply not enough," said ICO Deputy Commissioner David Smith.

"The penalty against Hounslow Council also makes clear that an organisation can't simply hand over the handling of the personal information it is responsible for to somebody else unless they ensure that the information is properly protected."

He added: "Both councils have paid the price for lax data protection practices. I hope all organisations that handle personal information will make sure their houses are in order otherwise they too may have to learn the hard way."

Both councils have been in contact with those whose details were involved. They have also improved policies and agreed to think about an ICO audit.

"These latest fines leave data controllers with absolutely no room for manoeuvre on the encryption issue; encryption of laptops and other devices must be considered to be mandatory now," said Stewart Room, partner in Field Fisher Waterhouse's Privacy and Information Law Group.

"We also see another early trend emerging; that ICO favours tough action against local authorities. At the moment there is nothing wrong with this, but I'm sure ICO will be alert to the fact that if it gives the appearance that it is aiming at soft targets - rather than tougher, big businesses - this will lead to criticism. Some people will think that ICO needs to be seen to take action against big business, so we will wait the next round of fines with eager anticipation"