St Albans District Council has written to postal voters regarding the theft of a laptop containing their personal data. The following Question and Answers have been provided to assist those people directly affected. The Council’s help line can be contacted on 01727 819291 or 819294 during office hours.
Questions and Answers
24th November 2009 Updated
What has happened?
The Council is looking into the disappearance of four laptops from its offices in St Peter’s Street, St Albans. The Council is working with the Police and Northgate Information Solutions which manages our IT services, to investigate the matter.
What was on the laptops?
Three of the laptops were new and are understood to hold no personal data. The fourth laptop contained some personal data concerning 14,673 residents who applied to cast their votes by post at the last elections held in the District on 4 June 2009. This consists of names, addresses, dates of birth, signatures and copies of scanned postal vote application forms and postal vote statements, which are used to confirm the identity of postal voters. No financial information was held.
Were details of how I voted at the last election included?
No. No details of the individual votes cast are known by, or held by, the Council.
Was the data protected/encrypted? Is my data safe?
The laptop was password protected and the elections software had a separate username and password, but the data itself was not encrypted. The Council is consulting with the Information Commissioner on next steps on data security.
Why was the data not encrypted?
Following the publication of security guidelines from Government Connect, the Council has invested in encryption software which is being installed on its laptops. As the guidelines relate to laptops that leave Council buildings, priority has been given to these. The laptop containing the election data was used inside the Council’s offices and would have been upgraded with encryption software in due course.
Will it affect my ability to use a postal vote in future?
No. All the data was backed up. Your postal vote will not be affected at the next election and you do not need to reapply.
How do I come off the list to receive a postal vote?
If you would like to remove your postal vote, please telephone 01727 819291 or 819294 during office hours, or write to the Electoral Services Department at St Albans City and District Council, Civic Centre, St Peter’s Street, St Albans AL1 3JE.
When did the laptop go missing?
The internal investigation will aim to pinpoint when the laptops disappeared. The disappearance of the laptop containing the postal voter data was confirmed on 9th November after a search of the Council’s offices.
Where was the laptop located?
The laptop was located in an area of the building which is accessible by electronic security swipe card.
Why was electoral information stored on a laptop?
The postal vote data was stored on a portable computer so that it can be easily used in the election work area within the Council’s offices for postal vote checking at election times.
Will people be receiving compensation for loss of information leading to identify fraud?
If people feel that they have been the subject of identity fraud as a result of this theft, they should contact the Council with evidence of this.
What should people do to protect themselves?
No financial information was stored on the laptop. But it is sensible for people to be watchful. If, for example, you are contacted unexpectedly by anyone asking for personal information or are at all suspicious, it is wise not to give out information until you are completely satisfied that it is a genuine enquiry. If you do have concerns you may wish to contact your bank or building society and make them aware of the situation.
What measures will the Council put in place to ensure that data is protected in the future?
The Council is conducting an internal investigation, led by its Head of Internal Audit. This will reveal what further security measures need to be put in place. In the meantime, the Council has made changes to its operational arrangements and IT security has been stepped up.
What are the internal control requirements and were they followed?
The laptop was in the part of the building protected by electronic swipe card access when it disappeared. The Council’s policy says: “computer equipment is vulnerable to theft, loss or unauthorised access. Always secure laptops and portable equipment when leaving an office unattended.” We are conducting an internal investigation to find out what happened in the case of this and the other three laptops.
Is my financial information held by the council secure?
The Council is taking further steps to review all our systems to reassure residents of the integrity of our procedures.
As a gesture, why doesn’t the council pay for a credit check service so we can be warned if this information is being used?
The Council is consulting with the Information Commissioner on next steps on data security.
Do I need to contact the police?
No, not unless you have evidence that you have been the subject of identify fraud or have information about the disappearance of Council laptops, in which case the Police can be contacted on 0845 3300 222.
Do I need to contact the Council?
If you would like to speak to the Council in person, you can contact the Council’s team on 01727 819291 or 01727 819294.
So what happens now?
The Electoral Commission and the Information Commissioner’s Office have been informed of the matter. The Chief Executive has ordered an investigation and we are working with the police and Northgate Information Systems, the company that manages the Council’s information technology services, to find out what happened.