The Information Commissioner’s Office (ICO) has issued a reprimand to Clyde Valley Housing after personal information was accessible to other residents in an online customer portal.
On the first day the portal launched in 2022, a resident discovered they could access documents related to ASB cases and view personal information about other residents, including names, addresses and dates of birth.
The resident called a customer service advisor at Clyde Valley Housing to flag the breach but their concerns were not escalated, and the personal information remained accessible for five days.
Following a mass email to residents promoting the portal, four more residents reported the same breach and the new system was suspended.
The ICO’s investigation found that the housing provider failed to test the portal appropriately before it went live and staff were not clear on the procedure to escalate a data breach.
Jenny Brotchie, regional manager for Scotland, ICO, said, “While new digital products and services can improve the experience for customers, these must not come at the cost of the security of personal information. This breach was the result of a clear oversight by Clyde Valley Housing when preparing to launch its new customer portal.
“We expect all organisations to ensure they have appropriate security measures when launching new products and have tested them thoroughly with data protection in mind, as well as ensuring staff are appropriately trained.”
