ICO fines Ministry of Justice £140k after prison leaks 1,182 prisoner details to families

'Clear lack of management oversight' in evidence, says David Smith

The Information Commissioner's Office has doled out its latest data breach fine, this time to the Ministry of Justice, to the tune of £140,000.

The ICO identified a "serious data breach", which saw details of all 1,182 prisoners serving time at HMP Cardiff sent to three families of inmates.

The breach was reported in August 2011 after a family member reported receiving a pre-visit email message to which was attached a spreadsheet sharing the details, which included release dates and coded details of crimes and offences committed, of the prisoners in the facility.

An internal investigation concluded that the same error had taken place on two occasions within the previous month, but both had gone unreported.

The investigation found that unencrypted floppy disks were regularly used to transfer large amounts of data between Cardiff HMP's two completely separate computer networks.

"Disclosing this information not only had the potential to put the prisoners at risk, but also risked the welfare of their families through the release of their home addresses," said ICO deputy commissioner and director of data protection, David Smith.

"Fortunately, it appears that the fall-out from this breach was contained, but we cannot ignore the fact that this breach was caused by a clear lack of management oversight of a relatively new member of staff.

"Furthermore, the prison service failed to have procedures in place to spot the original mistakes," continued Smith.