Justice Department fined after selling cabinet containing sensitive information

The Northern Ireland Department of Justice (DOJ) has been fined after auctioning cabinets containing confidential details of victims of terrorism attacks.

Following an investigation, the Information Commissioner has imposed a monetary penalty notice of £185,000 on the DOJ.

In 2012, the Compensation Agency Northern Ireland, an agency of the DOJ, auctioned off 59 filing cabinets. The purchaser of one of these cabinets, which was locked and sold without a key, found that it contained a number of papers dating from the 1970s through to 2005.

The files included information about the injuries suffered, family details and the amount of compensation offered, as well as confidential ministerial advice.

The buyer alerted Police Service Northern Ireland (PSNI) and the papers were returned. The DOJ reported the incident to the Information Commissioner’s Office (ICO).

Following an investigation, the DOJ is content that the cabinet remained locked until the purchaser forced it open and immediately reported the presence of papers to the PSNI.

ICO Assistant Commissioner for Northern Ireland, Ken Macdonald, said: “This is clearly a very serious case. While failing to check the contents of a filing cabinet before selling it may seem careless, the nature of the information typically held by this organisation made the error all the more concerning.

“The distress that could have been caused to victims and their families had this fallen into the wrong hands is self-evident.”

Justice Minister David Ford said the DOJ, takes the security of personal data very seriously and it accepts this was a breach of the Data Protection Act and should not have happened.

He said the DoJ informed the Information Commissioner as soon as it became aware of the breach. The Justice Committee was also subsequently made aware. The department has co-operated fully with the Information Commissioner and paid the penalty imposed.

“This was an unfortunate breach of data security caused by simple human error and not a systemic problem within the department. We are satisfied that none of the information was compromised and none of the other cabinets sold contained any files,” said Mr Ford.

“Detailed procedures have now been implemented to ensure that, in future, any personal data contained in furniture that is being disposed of will be dealt with securely.”

The fine has been lowered to £148,000 because of early payment.