Skip to main content

Heathrow Airport fined for losing a USB stick with employee data

(Image credit: Image Credit: Pitney Bowes Software)

Heathrow Airport Limited (HAL) has been ordered to pay a fine of £120,000 for not paying enough attention to data protection. 

Issuing the Monetary Penalty Notice (opens in new tab), the Information Commissioner's Office (ICO) said the penalty is being issued “because of a serious contravention of the Seventh Data Protection Principle”.

One of HAL’s employees had lost a removable stick a year ago. The stick contained more than a thousand of easily accessible, unencrypted files. On those files were, among other things, information about employees, their names, dates of birth and passport numbers. HAL aviation security personnel’s data was also compromised.

The stick ended up with the media, who had copied the contents before returning it to HAL.

But HAL wasn’t fined just for losing the stick, it was also fined because of poor data protection policies. As it turns out, just two per cent of its workforce had been trained for data security. HAL counts more than 6,000 employees.

ICO Director of Investigations, Steve Eckersley, said: “Data Protection should have been high on Heathrow’s agenda. But our investigation found a catalogue of shortcomings in corporate standards, training and vision that indicated otherwise. Data protection is a boardroom issue and it is imperative that businesses have the policies, procedures and training in place to minimise any vulnerabilities of the personal information that has been entrusted to them.”

The lucky circumstance for HAL is that the breach occurred before GDPR kicked in, otherwise the fine could have been much greater.

Image Credit: Pitney Bowes Software

Sead Fadilpašić is a freelance tech writer and journalist with more than 17 years experience writing technology-focussed news, blogs, whitepapers, reviews, and ebooks. And his work has featured in online media outlets from all over the world, including Al Jazeera Balkans (where he was a Multimedia Journalist), Crypto News, TechRadar Pro, and IT Pro Portal, where he has written news and features for over five years. Sead's experience also includes writing for inbound marketing, where he creates technology-based content for clients from London to Singapore. Sead is a HubSpot-certified content creator.