The Information Commissioner’s Office (ICO) has fined Islington Council £70,000 for failing to keep up to 89,000 people’s information secure on its parking ticket system website.
The system, in which residents can view a CCTV image or video of their alleged parking offence, had design faults that meant personal data could be accessed by manipulating the URL. This left the personal data of up to 89,000 people at risk of public access.
From the point of discovery in October 2015, it has been revealed that there had been unauthorised access to 119 documents on the system 235 times from 36 unique IP addresses, affecting 71 people - a clear breach of the Data Protection Act.
Sally Anne Poole, ICO enforcement manager, said: “People have a right to expect their personal information is looked after. Islington Council broke the law when it failed to do that. Local authorities handle lots of personal information, much of which is sensitive. If that information isn’t kept secure it can have distressing consequences for all those involved. It’s therefore vital that all council staff take data protection seriously.”