Information Commissioner's Office
North London council fined after parking ticket system flaw leaves personal information at risk
Islington Council failed to keep up to 89,000 people’s information secure on its parking ticket system website.
That was the conclusion of an Information Commissioner’s Office (ICO) investigation which has resulted in a £70,000 fine for the London borough.
Islington Council’s Ticket Viewer system allows people to see a CCTV image or video of their alleged parking offence. It was found to have design faults meaning the personal data of up to 89,000 people was at risk of being accessed by others. That data included a small amount of sensitive personal information such as medical details relating to appeals.
The problem came to light in October 2015 when Islington Council was informed by a member of the public using the system that folders containing personal data could be accessed by manipulating the URL.
It was discovered that there had been unauthorised access to 119 documents on the system 235 times from 36 unique IP addresses, affecting 71 people.
Sally Anne Poole, ICO Enforcement Manager, said:
“People have a right to expect their personal information is looked after. Islington Council broke the law when it failed to do that.
“Local authorities handle lots of personal information, much of which is sensitive. If that information isn’t kept secure it can have distressing consequences for all those involved. It’s therefore vital that all council staff take data protection seriously.”
The ICO found that the council should have tested the system both prior to going live and regularly after that.
In failing to do so, the London borough failed to take the appropriate technical measures to keep personal information secure. This was a breach of the Data Protection Act.
Data protection laws are set to get tougher and councils have work to do to get ready. Earlier this year the ICO published the results of its local government survey, which showed many authorities were not yet prepared for the new General Data Protection Regulation.
The GDPR, which applies from May 2018, requires a privacy impact assessment is carried out in certain circumstances when using new technologies and the processing is likely to result in a high risk to the rights and freedoms of individuals.
Notes for Editors
- The Information Commissioner’s Office upholds information rights in the public interest, promoting openness by public bodies and data privacy for individuals.
- The ICO has specific responsibilities set out in the Data Protection Act 1998, the Freedom of Information Act 2000, Environmental Information Regulations 2004 and Privacy and Electronic Communications Regulations 2003.
- The ICO can take action to change the behaviour of organisations and individuals that collect, use and keep personal information. This includes criminal prosecution, non-criminal enforcement and audit. The ICO has the power to impose a monetary penalty on a data controller of up to £500,000.
- The European Union’s General Data Protection Regulation (GDPR) is a new law which will apply in the UK from 25 May 2018. The Government has confirmed the UK’s decision to leave the EU will not affect the commencement of the GDPR. The Government is introducing measures related to this and wider data protection reforms in a Data Protection Bill.
- Anyone who processes personal information must comply with eight principles of the Data Protection Act, which make sure that personal information is:
- fairly and lawfully processed;
- processed for limited purposes;
- adequate, relevant and not excessive;
- accurate and up to date;
- not kept for longer than is necessary;
- processed in line with your rights;
- secure; and
- not transferred to other countries without adequate protection.
- Civil Monetary Penalties (CMPs) are subject to a right of appeal to the (First-tier Tribunal) General Regulatory Chamber against the imposition of the monetary penalty and/or the amount of the penalty specified in the monetary penalty notice.
- Any monetary penalty is paid into the Treasury’s Consolidated Fund and is not kept by the Information Commissioner’s Office (ICO).
- To report a concern to the ICO telephone our helpline 0303 123 1113 or go to ico.org.uk/concerns.
Latest News from
Information Commissioner's Office
Company previously fined for making nuisance calls is prosecuted for failing to change its ways15/02/2018 10:20:00
A company that has already been fined for making nuisance calls has now been prosecuted in a criminal court for continuing to break the law.
Accident recovery firm employee who sold personal data to nuisance callers is fined09/02/2018 13:25:00
A former worker at an accident repair firm who downloaded and sold the personal data of motorists to nuisance callers has been fined.
Information rights and responsibilities, with the Information Commissioner03/02/2018 10:10:00
Elizabeth Denham’s speech at the Association of Chief Executives and Public Chairs' Forum joint event, on Friday 2 February 2018
Holmes Financial Solutions Ltd fined £300,000 after making 8.7 million nuisance calls02/02/2018 09:10:00
A company that made 8.7 million nuisance calls has been fined £300,000 by the Information Commissioner’s Office (ICO).