The data protection watchdog the ICO has fined The Money Shop £180,000 after the company lost computer servers containing details of several thousand customers. In two separate incidents reported to the Information Commissioner’s Office (ICO), one server was stolen from the company’s branch in Lurgan, Northern Ireland and a month later a second server was lost by a courier firm in Swindon.
Neither server had sufficient encryption systems for the company to be confident that the information they contained could not be accessed, according to the regulator. The servers, which have still not been recovered, held large numbers of local and national customer records and employee details.
The company’s procedure was that servers should be stored in a separate locked room, but the ICO found that the Lurgan store, and a significant number of other Money Shop branches, didn’t have separate rooms that could be used in this way. The company also had a widespread practice of regularly transporting unencrypted servers between its head office in Nottingham and its branches nationally and old customer records were not being deleted.
The regulator’s head of enforcement, Steve Eckersley said: “Customers of The Money Shop entrusted the company with their personal and financial details with the expectation that the information would be kept safely and securely. Our investigations discovered that this wasn’t the case and that this information was regularly left exposed when equipment was moved around the country. There was potential for fraud and financial loss to customers which is unacceptable and in both cases, had the data been properly encrypted the damage and distress to customers and the monetary penalty could have been avoided.
“Hopefully it’s an example to other organisations, whatever business they may be in, that the safety of personal information must be taken seriously. Policies and procedures must be put in place or we will take action.”
Visit https://ico.org.uk/for-organisations/guide-to-data-protection/.
