Investigation revealed that URL on portal could be manipulated to access personal data of people subject to fines
Islington Council has been fined £70,000 by the Information Commissioner’s Office (ICO) for failing to keep personal information secure on its parking ticket system website.
The ICO said the London borough’s Ticket Viewer system, which allows people to see a CCTV image or video of their alleged parking offence, was found to have design faults that created the risk of the data of up to 89,000 people being accessed by others. It included a small amount of sensitive personal information such as medical details relating to appeals.
The problem came to light in October 2015 when Islington was informed by a member of the public using the system that folders containing personal data could be accessed by manipulating the URL. It was discovered that there had been unauthorised access to 119 documents on the system 235 times from 36 unique IP addresses, affecting 71 people.
In the course of an investigation the ICO found that the council should have tested the system both prior to going live and regularly after that. In failing to do so, it failed to take the appropriate technical measures to keep personal information secure - breaching the Data Protection Act.
Sally Anne Poole, ICO enforcement manager, said: “People have a right to expect their personal information is looked after. Islington Council broke the law when it failed to do that.
“Local authorities handle lots of personal information, much of which is sensitive. If that information isn’t kept secure it can have distressing consequences for all those involved. It’s therefore vital that all council staff take data protection seriously.”
Image: Islington Town Hall by Alan Ford at English Wikipedia, public domain.