Estate agent dodges GDPR-sized bullet after exposing 18,610 folks’ data for two years
A London estate agent has been fined £80,000 for losing thousands of clients’ personal data when it was handed over to a third party.
A ruling from the Information Commissioner’s Office found Life at Parliament View Ltd (LPVL) left the personal details of 18,610 people available online for just under two years. The data was from both tenants and landlords and included bank statements, salary details, dates of birth and other information including copies of passports.
The loss occurred when the estate agent passed the details from its own servers onto a partner company and failed to switch off an “Anonymous Authentication” function, which meant there were no access restrictions to the data between March 2015 and February 2017.
The ICO said its investigators “uncovered a catalogue of security errors and found that LPVL had failed to take appropriate technical and organisational measures against the unlawful processing of personal data”.