Student data breach just days after ICO speech

Students signing up for an NUS discount card at the University of Leicester were emailed their personal details along with the personal data of the other 3,396 students who had also signed up for the card.

The email was sent out by the local students' union and included course information as well as phone numbers and dates of birth. The union has apologised for the "serious human error" and the police have been called in to prevent identity fraud.

Richard Thomas, the Information Commissioner, said in a speech on Wednesday that those in charge of personal data must stop leaving its security to the "IT boys".

The e-mail was sent on 24 October. It contained the names, mobile phone numbers, gender, date of birth and country of origin of every student who had signed up for the discount card at the university.

An investigation in to how this happened is understood to be underway. Kumaran Ambalavanar, acting general manager of Leicester Students' Union, told the BBC: "We take protection of our union members' information very seriously and very much regret this incident occurring. We will set in place procedures to ensure this type of error does not recur."

Caroline Roberts, The director of legal and public affairs at the DMA said the case reaffirmed how important it is for organisations to have strict regulations in place when dealing with sensitive data. "Even the smallest organisations need to abide by data security law. It's often a case of just stopping and thinking. There is a lot of good advice on the ICO's website."

Thomas said this week that data protection has "never been more important". His office is investigating 30 of the most serious breaches of data protection law out of a total of 277 security breaches in a year by the government, private companies and other bodies.