Home Office warned after sensitive documents left at London venue

The documents, which were handed by venue staff to the police back in September last year, included two Extremism Analysis Unit Home Office reports and a Counter Terrorism Policing report. The reports contained personal data, including that of Metropolitan Police Service staff.

A Government investigation concluded that the Home Office was the most likely source of the documents. The reprimand has been issued to the Secretary of State for the Home Department (ie the Home Secretary Suella Braverman) as the data controller for the Home Office.

The ICO found that the Home Office had failed to ensure an appropriate level of security of personal data, including where documents were classified as ‘Official Sensitive’. The investigation also unearthed the fact that the Home Office did not have a specific sign-out process in place for the removal of documents from the premises.

Further, the incident was not reported to the ICO within the 72-hour time limit.

Expectation in law

Information Commissioner John Edwards stated: “Government officials are expected to work with sensitive documents in order to run the country. There is an expectation, both in law and from the people the Government serves, that this information will be treated respectfully and securely. In this instance that did not happen. I expect the Home Office to take steps to avoid similar mistakes in the future.”

The Home Office has indeed since taken steps to avoid similar breaches occurring in the future.

The reprimand from the ICO sets out further actions needed, including a review of the handling instructions around ‘Official Sensitive’ information, consideration of a sign-out process when documents leave the office and a review of training provided to members of staff around the handling of records containing personal data.

Independent regulator

The ICO is the UK’s independent regulator for data protection and information rights law, upholding information rights in the public interest, promoting openness by public bodies and also data privacy for individuals.

The ICO harbours specific responsibilities as set out in the Data Protection Act 2018, the United Kingdom General Data Protection Regulation, the Freedom of Information Act 2000, the Environmental Information Regulations 2004, the Privacy and Electronic Communications Regulations 2003 and, indeed, a further five acts and regulations.

In June this year, the Information Commissioner announced a trial that sees a greater use of his discretion to reduce the impact of fines levied on members of the public where public authorities breach data protection law. In practice, this means an increase in public reprimands and the use of wider powers, including Enforcement Notices, with fines only issued in the most egregious cases.

The ICO can take action to address and change the behaviour of organisations and individuals that collect, use and keep personal information. This includes criminal prosecution, non-criminal enforcement and audit procedures.