Peter A Clarke

Proper enforcement by privacy regulators is critically important to establishing a culture of privacy compliance.  There are also strong public policy reasons to ensure that the privacy laws are not ignored.  The Federal Trade Commission in the United States has been quite assertive in using the limited powers it has to ensure that businesses do not mislead on privacy protections used or privacy enhancing products that are sold.  The UK Information Commissioner’s office has also been quite rigorous in taking action for privacy breaches.  Unfortunately the Australian Privacy Commissioner has adopted an entirely different approach.  He has been restrained to the point of timid.  Perhaps worse When action has been taken the outcome has been anaemic.

The ICO has fined the Money Shop the swinging sum of £180,000 for loss of data due to poor data protection.

The media statement provides:

The ICO has issued a £180,000 civil monetary penalty to The Money Shop after the company lost computer servers containing details of several thousand customers.

In two separate incidents reported to the regulator, one server was stolen from the company’s branch in Lurgan, Northern Ireland and a month later a second server was lost by a courier firm in Swindon.

Neither server had sufficient encryption systems for the company to be confident that the information they contained could not be accessed. The servers, which have still not been recovered, held large numbers of local and national customer records and employee details.

The company’s procedure was that servers should be stored in a separate locked room, but an ICO investigation found that the Lurgan store, and a significant number of other Money Shop branches, didn’t have separate rooms that could be used in this way. The company also had a widespread practice of regularly transporting unencrypted servers between its head office in Nottingham and its branches nationally and old customer records were not being deleted.

ICO’s Head of Enforcement, Steve Eckersley said: “Customers of The Money Shop entrusted the company with their personal and financial details with the expectation that the information would be kept safely and securely. Our investigations discovered that this wasn’t the case and that this information was regularly left exposed when equipment was moved around the country. There was potential for fraud and financial loss to customers which is unacceptable and in both cases, had the data been properly encrypted the damage and distress to customers and the monetary penalty could have been avoided.

“Hopefully it’s an example to other organisations, whatever business they may be in, that the safety of personal information must be taken seriously. Policies and procedures must be put in place or we will take action.”