Missing memory stick found in Leicester council worker's lunch bag

[Alison J Stevens]

Missing memory stick found in Leicester council worker's lunch bag

Leicester City Council faces a fine of up to £500,000

By david maclean political correspondent

A missing memory stick containing the medical and security details of thousands of Leicester residents has been discovered – in an employee's lunch bag.

The device disappeared last month from the offices of LeicesterCare, the city council service which supports vulnerable residents.

But at the weekend it was discovered in a plastic carrier bag, thought to have been used by an employee to carry lunch to work.

The council faces a fine of up to £500,000 for temporarily losing the device, which holds information about 4,000 elderly and vulnerable people.

A spokesperson for Leicester City Council said: "We have continued our search for the missing data stick and, as a result, can confirm that it was found over the weekend.

"As soon the data stick had been recovered, we ran a series of tests on it which indicated that the data on it has not been accessed during the period the device was missing.

"We are continuing with our investigation into the incident and will report fully on its findings as soon as this has been completed."

The employee whose bag the stick was found in will now be interviewed as part of the investigation.

A council worker, who was involved in the hunt for the stick, said: "Data protection is a massive worry for councils these days and there was utter panic when it was first discovered that the disk was lost.

"The fact that details on there were from some of the most vulnerable folks in Leicester made matters even worse.

"There was relief all round when it was found and things are already being tightened up to make sure that we know where all of our sensitive data is at any one time."

The missing device was used as a back-up to record information on council computers and was locked in a safe each night.

It is understood that the equipment was encrypted, so it would have been difficult for anyone intercepting the device to read the information contained on the stick.

The loss of the memory stick has already been reported to police and the Government's Information Commissioner's Office (ICO), which has started its own investigation.

If the city council is found to have failed to meet ICO guidelines, it could be fined a maximum of £500,000.

An ICO spokesman said: "The main concerns for us are whether or not the organisation has done enough to prevent that breach and whether or not the breach has caused damage."

The council has contacted all 4,000 people with medical information contained on the disk, and visited the 2,000 of those whose keysafe codes were also on the disk.

The codes are used to open boxes, attached to an outside wall of people's homes, which contain a key to the front door. The council has now changed nearly all of the codes.