Students' union in e-mail gaffe

By Siobhan Courtney
Interactive reporter, BBC News

The offending e-mail was recalled shortly after being sent

A file revealing the personal details of thousands of University of Leicester students has been e-mailed by mistake.

It was sent out by the local students' union and featured information such as phone numbers and dates of birth.

The union said the file was sent to all of the 3,396 students who had bought an NUS discount card and it apologised for the "serious human error".

A spokesman said the police had been called in to prevent identity fraud.

The e-mail was sent on 24 October to every student who had bought a National Union of Students Extra discount card.

It contained the names, mobile phone numbers, gender, date of birth, course details and country of origin - among other details - of others who had signed up for the same scheme.

Kumaran Ambalavanar, acting general manager of Leicester Students' Union, told BBC News an investigation has begun.

'Union regret'

He said: "We take protection of our union members' information very seriously and very much regret this incident occurring.

"We have also communicated with everyone affected and apologised for the mistake and will set in place procedures to ensure this type of error does not recur."

The university has sent an e-mail to all the students involved, on behalf of the union, to reassure them that Leicestershire Police and data protection officials had been called in to prevent identity fraud.

That e-mail said: "There were 3,396 records on the database. We recalled the message so we know that the majority of recipients did not receive the attachment. We do not know exactly how many would have received and read the attachment."

One of the students involved, who asked not to be named, said: "This is very worrying, I just couldn't believe it when I received this e-mail and saw everyone's personal details."

'Toxic liability'

Simon Davies, director of the pressure group Privacy International, said the students "now face a significant risk of impersonation leading to identity theft and other crimes".

He added: "Such a huge amount of personal data should never have been sent insecurely by e-mail under any circumstances. The action can only be described as reckless and thoughtless."

The UK's information watchdog warned this week that many companies did not understand the risks of storing personal data.

Information Commissioner Richard Thomas said personal data could be a "toxic liability" as well as an asset to an organisation.

He is investigating 30 "serious" breaches of data protection law by the government and other bodies.

---

Click here to send us your story ideas

---