The Home Office has been reprimanded by the Information Commissioner for last year's loss of 84,000 prisoner records on a memory stick issued to contractor PA Consulting. This is an important decision by the ICO, since it reinforces the law that even if a Data Processor loses or misuses information, it is the Data Controller that has legal responsibility for its protection.
The ICO has also instructed the Home Office to sign a formal undertaking to improve its procedures for protecting data - I wonder if they can be persuaded to sign the Personal Information Promise at the same time?
