Kingston Council could be faced with fines of thousands of pounds if an investigation finds it has breached data protection laws.

The Information Commissioner’s Office (ICO) is set to investigate after more than 100 rent statements were posted to the wrong addresses in Chessington.

Residents in Charles Lesser House, Hereford Way, were shocked to find their two-page rent statements contained one sheet of their own information and a second page with somebody else’s personal data.

The council has apologised for the blunder and vowed to carry out a review of its mailing system, but many residents were outraged that their privacy had been compromised.

The data included details of housing benefits entitlements and other benefits, the name of the bank each tenant used, their rent account number and any supporting people’s transfer details.

The head of Charles Lesser House Residents’ Association, Keith Dickinson, 62, said: “It seems a total breach of confidentiality between the royal borough of Kingston and their clients.

“I am more than a bit disappointed – we have been let down. This is a sheltered housing group and we have a lot of vulnerable people living here. This was an invasion of privacy.”

Retired Mohammed Mohammed, 68, who has lived in Charles Lesser House for three years, said: “I feel bad because I have got nothing to hide in my statement but someone else could have money troubles – they would not want their neighbours to know. Now everyone knows.”

Kingston Council issues 7,000 rent statements to tenants on a quarterly basis.

The latest rent statements were affected by a problem with the council’s mailing machine that resulted in an error.

A spokesman for Kingston Council said: “This is an isolated problem affecting less than 2 per cent of the statements sent out.

“It is also important to note that no bank account information, national insurance or anything that could compromise the safety of tenants or be used to commit fraud are included in the rent statement.

“The council regrets any inconvenience this error caused and we are reviewing our quality control arrangements for mass mailing.

“We will also be re-issuing the statements to those affected along with an apology.”

In the mix-up, which was predominantly in Chessington, a rent statement from Ewell Road in Surbiton also ended up with a Charles Lesser House tenant.

An ICO spokesman said organisations must make sure that appropriate technical and organisational measures are taken to prevent unauthorised or unlawful processing of personal data.

If organisations were found to have seriously breached the rules a fine of up to £500,000 could be imposed.

The spokesman said: “We will be making inquiries into the circumstances of the alleged breach of the Data Protection Act before deciding what action, if any, needs to be taken.”