The British Council, which promotes cultural and educational ties abroad, said the CD was lost by courier firm TNT, contained the bank details, national insurance number and names and addresses of over 2,000 employees. At the time, the British Council said the data was encrypted, by an investigation by the ICO has shown this was not the case.
"The British Council proactively reported the breach to the ICO and took immediate remedial action which demonstrates its understanding of the seriousness of this data loss," said Mick Gorrill, assistant Information Commissioner.
"The Data Protection Act clearly states that organisations must take appropriate measures to ensure that personal information is kept secure."
As a result of the investigation, the ICO has asked the British Council sign an agreement confirming that from now on all data stored on portable devices will be encrypted.
"The organisation also agrees to ensure that its policies on the transfer and sharing of personal information on portable devices are clear and compliant with government standards," added Gorrill.