Islington Council has received a £70,000 fine after an investigation found it failed to secure the personal details of up to 89,000 people on its parking ticket system.
The Information Commissioner’s Office (ICO) found design faults of the system meant personal data could be accessed by manipulating the URL. This including medical details relating to parking appeals.
The investigation discovered there had been unauthorised access to 119 documents on the system 235 times, affecting 71 people.
Sally Anne Poole, ICO enforcement manager, said: ‘People have a right to expect their personal information is looked after. Islington Council broke the law when it failed to do that.
‘Local authorities handle lots of personal information, much of which is sensitive. If that information isn’t kept secure it can have distressing consequences for all those involved. It’s therefore vital that all council staff take data protection seriously.’
The ICO ruled the council had breached the Data Protection Act by failing to test the system both prior to going live and regularly after that.
Islington Council has repeated its apology and says it accepts a fine imposed by the ICO.
An Islington Council spokesperson said: 'We remain very sorry about the previous Ticketviewer problem and agree with the ICO that we failed to meet the required data protection standards back in 2015. As soon as we were aware of the problem we took every possible action to prevent a recurrence and instructed auditors to carry out a thorough review so we could learn from our mistake.'
Prompt payment by the council has seen the fine reduce to £56,000.
