Social landlords rapped for putting London tenants' data at risk
Details of more than 26,000 social housing tenants were left in a pub on an unencrypted memory stick.
The Information Commissioner's Office (ICO) said two London housing bodies had breached the Data Protection Act.
The memory stick belonged to a contractor working for Lewisham Homes who had previously also worked for Wandle Housing Association.
The memory stick was handed into the police on the weekend of the 5th March and safely retrieved.
It was found at the All Inn One in Forest Hill, south London.
The contractor had copied the information held on the memory stick from both organisations' networks.
The device contained the details of more than 20,000 tenants of Lewisham Homes and 6,200 tenants of Wandle Housing Association.
End Quote Sally-Anne Poole Acting head of enforcement, ICO
There is no suggestion that the data was misused”
Some 800 of the records belonging to Lewisham Homes also contained tenants' bank account details.
Both organisations have agreed to make sure that all portable devices used to store personal information are encrypted.
They will also have to make sure that all staff, including contractors, follow policies and procedures on the handling of personal information.
Sally-Anne Poole, acting head of enforcement at the ICO, said: "Saving personal information on to an unencrypted memory stick is as risky as taking hard copy papers out of the office.
"Luckily, the device was handed in and there is no suggestion that the data was misused. But this incident could so easily have been avoided if the information had been properly protected."
Ms Poole welcomed the two housing associations' commitments to make sure that all contractors follow their guidance on keeping personal information secure.
A spokesperson for Lewisham Homes, said it had since strengthened its data security measures and the contractor who lost the memory stick had been dismissed.
"We investigated the risk of personal data being lost and are confident that no personal data was compromised as the data stick was immediately handed into the police," they added.