Home Office reprimanded over sensitive counter-terror documents left at venue

The Home Office has been reprimanded by the UK's data protection watchdog after classified counter-terrorism documents were left at a London venue.

An envelope containing four documents labelled as “official sensitive” was found by staff on September 5 2021, who handed them in to police the next day.

This prompted an investigation by the Information Commissioners Office, whose job is to uphold data privacy rights.

The documents included two reports from the Home Office's extremism analysis unit and a counter-terrorism policing report.

Personal data of two members of Metropolitan Police staff and a “foreign United Kingdom visa applicant who is the subject of the documents” were contained in the files.

The ICO found the Home Office “failed to ensure an appropriate level of security of personal data” and for documents classified as “official sensitive”.

As the department's data controller, Home Secretary Suella Braverman was issued with a formal reprimand over the incident.

Information Commissioner John Edwards said: “Government officials are expected to work with sensitive documents in order to run the country.

"There is an expectation, both in law and from the people the Government serves, that this information will be treated respectfully and securely.

“In this instance that did not happen, and I expect the department to take steps to avoid similar mistakes in the future.”

The investigation also concluded the Home Office did not have a proper process for signing out documents from its offices and should have reported the incident to the ICO within a 72-hour time limit.

Want a quick and expert briefing on the biggest news stories? Listen to our latest podcasts to find out What You Need To Know.

In a letter to Home Office permanent secretary Matthew Rycroft, the ICO said the breach was not reported by the department until April 4 this year, even though its staff had been informed the day after the incident.

A Cabinet Office investigation concluded the Home Office was the most likely source of the documents.

The ICO did not say where the incident took place and refused to confirm the type of venue, other than it was a “public” place.

A spokeswoman for the organisation, which says it "promotes openness by public bodies", said providing details of the venue was “not necessary”.

The Home Office has since taken steps to avoid similar breaches occurring in the future, the ICO said.

But it called for more improvements to be made, including a review of how such documents should be handled, a proper process for signing out documents from offices and a review of training for staff on handling records containing personal data.

Responding to the ICO’s reprimand, a Home Office spokesman said: “The UK has one of the most robust and transparent oversight regimes for the protection of personal data and privacy anywhere in the world.

“We note the decision published by the Information Commissioners Office today and will take its implications into consideration.

“We continue to ensure that robust controls and independent oversight are in place to ensure we are fully compliant with requirements on processing of personal data.”