A payroll company that left two unlocked shredding bins full of personal documents at a vacated office has been reprimanded by the Information Commissioner.
Payroll Partners Limited (PPL) experienced a “significant loss of control of personal data” following the closure of its local operations in March 2024 after a merger, the island’s ICO said.
In August 2024, the company’s former landlord reported that the bins containing personal payroll documents had been found at the empty office.
The ICO collected the documents and conducted dup sampling of five boxes which revealed more than 9,700 records containing personal and special category data, including names, salary information, immigration documents and photographs.
Records dated from 2006 to 2024.
The ICO said the business shutdown was “not managed properly” and the company “didn’t have good enough controls in place”.
In its reprimand, the ICO stated: “Leaving the bins behind showed that the company failed to follow basic data protection rules, especially for handling sensitive personal information.”
Despite PPL attempting to retrieve the bins through local personal contacts, it did not take further formal legal procedures.
The company also did not recognise the situation as a data breach or report it to the ICO.
The ICO said “clear destruction processes are essential” and holding vast amounts of historical data “shows a lack of retention policy”.