Shropshire Council was today rapped over the knuckles after officials lost a computer memory stick which contained personal information about vulnerable members of the public.

The unencrypted memory stick also contained details about members of the council’s own staff who were working in the sensitive adult social care department.

The stick, which contained a social care management database, including contact details and sensitive health information, was lost during a postal transfer from the council to a contractor in Cardiff.

The Information Commissioner’s Office said the loss breached the Data Protection Act. The authority today said it was “extremely sorry” for the loss of the memory stick but stressed there was no evidence the information on it had been found or misused.

The memory stick contained records which the ICO said were “excessive” for their purpose and out of date.

The ICO said that since the incident the council had worked closely with it to ensure that lessons were learned and has signed a formal undertaking to ensure databases only contain relevant and up-to-date information and that this is only transferred to portable devices such as memory sticks where absolutely necessary.

The undertaking also requires the encryption of portable and mobile devices used to store and transmit personal data.

Mick Gorrill, assistant information commissioner, said: “It is essential that organisations ensure the correct safeguards are in place when storing and transferring personal information, especially when it relates to such sensitive issues.

“Information must be kept be kept safe, secure and up to date. These are important principles of the Data Protection Act.”

Val Beint, Shropshire Council’s director of community services, said this was the first recorded incident of its kind at the authority and it was “extremely sorry” it had happened.

She said the council took security very seriously and had taken immediate steps to ensure that nothing like this happened again.

By Dave Morris