The Stolen Laptop and 1,240 Home Visits
A watch manager has been running home fire safety visits from a spreadsheet of 1,240 rows. Each row holds a name, address, phone number, mobility and health notes, and a four-digit keysafe code, plus a column showing whether the household was referred to social services. The file lives on her personal laptop, which was stolen from her car overnight along with a USB stick kept in the glovebox. She had been emailing it to her personal webmail account to work on at weekends. The station's shared drive copy is five months old and password protection on the file consisted of a password written on a sticky note inside the laptop bag.
1. Set out your first three actions in order and justify the sequence - containment first, or recovery first?
Read the worked answer
1. Contain, then recover. First: remote-wipe the laptop if the device is managed, change the account password and revoke sessions, and confirm whether the USB and webmail copies still exist. Recovery of the file from the shared drive is worthless if the stolen copy is still live in a mailbox.
2. Report internally to the data protection lead immediately, in writing, with facts: what data, how many people, what identifiers, what has been done. Do not investigate quietly for a day first; delay is the single most damaging factor in how a breach is judged.
3. Assess and notify. Keysafe codes plus addresses are a physical-safety risk, not just a privacy one - those codes should be treated as compromised and changed. Regulators typically expect notification within 72 hours where a risk to individuals is likely; the lead decides, but the decision must be recorded.
Why this order: containment limits harm, reporting starts the clock and preserves evidence, notification is decided with the facts in hand. Doing notification first means telling people something you may have to correct later.
2. Classify the fields in the spreadsheet and state what the service should have collected, stored and where.
Read the worked answer
Classification:
- Name, address, phone - personal data.
- Mobility, health notes, social services referral - special category health/social data, needing the strongest handling.
- Keysafe code - a physical access credential; its loss is a safety incident, not only a data incident.
What was wrong: the file combined four different risk levels into one flat spreadsheet with one weak password, held off-site on unmanaged equipment and synced to personal webmail. The keysafe code had no business being in the same file as the health notes - a visit needs the code; the referral record does not.
Minimum redesign: a managed device only, no personal webmail ever, access restricted to those scheduling and conducting visits, keysafe codes held in a separate access-controlled register cleared after each visit, health notes replaced by a simple flag ("requires assistance to evacuate") unless the detail is needed, and a retention rule that deletes rows after a set period. Anything not needed to deliver the visit should not be collected at all.
3. What do you tell the 1,240 households, and how does the answer change for those whose keysafe codes were in the file?
Read the worked answer
General message: short, plain and specific - what was on the laptop, when it was taken, what we have done, what we are doing next, and one phone number and named person for questions. No euphemism like "a data incident involving some records"; people need to recognise themselves.
Honesty about uncertainty: we do not know whether the file will be accessed, so say that rather than reassure falsely. Over-reassurance that later proves wrong destroys trust more than the theft did.
For households with keysafe codes: treat it as urgent and different in kind. The risk is a stranger at the door, not a marketing list. Advise changing the code or removing the key, offer to do it, and consider a targeted visit for anyone who cannot act on the letter. Prioritise by vulnerability, not alphabetically.
Practical points: issue letters in accessible formats, log who was contacted and when, and keep the message consistent with what the regulator and the social services team are told. Three versions of the story is the failure mode.