Ministry of Justice – Violation Found (United Kingdom, 2023)

Confidential waste documents were left in an unsecured prison holding area. Prisoners and staff had access to the 14 bags of confidential documents, which included medical and security vetting details, for a period of 18 days. During this time staff challenged prisoners who were openly reading the documents, but did nothing proactive to ensure the personal information was secured. At least 44 people had access to the information, which had remained on site as a contracted shredder waste removal company had not collected as scheduled. The ICO has issued a formal reprimand to the Ministry of Justice (MoJ). The ICO investigation uncovered a lack of robust policies at the prison including: no pre-agreed areas for staff to leave confidential waste in a secure place; staff being unaware of the need to shred information or the risks of allowing prisoners access to non-shredded confidential documents; inaccurate records of the number of staff who had completed data protection training; and a general lack of staff understanding of the risks to personal data and the need to report data breaches.