Home Office reprimanded after sensitive counter-terror documents left at venue

The Home Office has been reprimanded by a watchdog after sensitive counter-terrorism documents were left at a London venue.

The documents, which were handed to the police in September last year after being found by venue staff, included two reports from the Government department’s extremism analysis unit and a counter-terrorism policing report.

Both contained personal data, including that of Metropolitan Police staff, the Information Commissioner’s Office (ICO) said.

The watchdog found the Home Office “failed to ensure an appropriate level of security of personal data” and for documents classified as “official sensitive”, so issued Home Secretary Suella Braverman, the department’s data controller, with a formal reprimand.

Information Commissioner John Edwards said: “Government officials are expected to work with sensitive documents in order to run the country. There is an expectation, both in law and from the people the Government serves, that this information will be treated respectfully and securely.

“In this instance that did not happen, and I expect the department to take steps to avoid similar mistakes in the future.”

The investigation also concluded the Home Office did not have a proper process for signing out documents from its offices and should have reported the incident to the ICO within a 72-hour time limit.

In a letter to Home Office permanent secretary Matthew Rycroft, the ICO said the breach was not reported by the department until April 4 this year even though its staff had been informed the day after the incident.

An envelope containing four documents classified as “official sensitive” was found at the venue by staff on September 5 2021.

They handed them to police the next day, who gave them back to the Home Office.

The papers contained the personal data of two Met staff and a “foreign United Kingdom visa applicant who is the subject of the documents”.

A Cabinet Office investigation concluded the Home Office was the most likely source of the documents.

The ICO did not say where the incident took place and refused to confirm the type of venue, other than it was a “public” place.

A spokeswoman for the body said providing details of the venue was “not necessary”.

The Home Office has since taken steps to avoid similar breaches occurring in the future, the ICO said, but it called for more improvements to be made, including a review of how such documents should be handled, a proper process for signing out documents from offices and a review of training for staff on handling records containing personal data.

Responding to the ICO’s reprimand, a Home Office spokesman said: “The UK has one of the most robust and transparent oversight regimes for the protection of personal data and privacy anywhere in the world.

“We note the decision published by the Information Commissioners Office today and will take its implications into consideration.

“We continue to ensure that robust controls and independent oversight are in place to ensure we are fully compliant with requirements on processing of personal data.”