The ICO investigated the security breach that affected the
UKvisas site in May. The site is run by the Foreign and
Commonwealth Office and the Home Office. The ICO found that
personal data belonging to visa applicants was visible by site
visitors. This broke the Data Protection Act, said the ICO.
"Organisations have a duty under the Data Protection Act to keep
our personal information secure," said Mick Gorrill, ICO assistant
commissioner. "If organisations fail to take this responsibility
seriously, they not only leave individuals vulnerable to identity
theft but risk losing individuals’ confidence and trust."
The ICO said that the Foreign Office co-operated with its
investigation and provided the Commissioner with an independently
produced report on the matter.
The Foreign Office has promised to close the website it was
using and replace it with another, as well as to audit the
procedures used. It also promised to undertake a strategic review
of data processing.
"The data controller shall, as from the date of this undertaking
and for so long as similar standards are required by the Act or
other successor legislation from other data controllers in similar
circumstances, ensure that personal data is processed in accordance
with the Seventh Data Protection Principle," said the undertaking
signed by the Foreign Office. The seventh data protection principle
demands security for people's information.
