A housing association breached the Data Protection Act when details relating to thousands of their tenants were discovered on an unencrypted memory stick left in a pub, the Information Commissioner’s Office (ICO) has ruled.

Wandle Housing Association, which has its headquarters in Abbeville Road, Clapham, agreed to "re-examine" and "reinforce" security procedures following an investigation by independent authority, the ICO.

Today, the ICO revealed the memory stick, which was left in an undisclosed London pub, contained details of more than 20,000 tenants of Lewisham Homes and 6,200 tenants of Wandle Housing Association.

It added the memory stick, which belonged to a contractor who was carrying out work for Lewisham Homes and had previously also worked for Wandle Housing Association, was safely retrieved and handed into police "at a later date".

The association looks after residents in 11 boroughs across south London, including Wandsworth, Merton, Kingston, Sutton, Lambeth and Croydon.

Both organisations have agreed to make sure that all portable devices used to store personal information are encrypted. All staff, including contractors and temporary staff, will also be monitored to ensure they follow personal information security guidelines.

Sally-Anne Poole, acting head of enforcement at the ICO, said: "Saving personal information on to an unencrypted memory stick is as risky as taking hard copy papers out of the office.

"Luckily, the device was handed in and there is no suggestion that the data was misused. But this incident could so easily have been avoided if the information had been properly protected."

A spokeswoman for Wandle Housing Association said: "We are very sorry that this has caused worry or distress for any of our residents.

"This memory stick was immediately and safely retrieved from the landlord of the pub and we are confident that personal information about our residents is not in the public domain. Of course we have learned a very valuable lesson here and have re-examined and reinforced all of our data protection procedures.

"We have set up further safeguards and are retraining all members of staff so that an incident such as this cannot happen again."

• What do you think? Let us know by emailing imason@london.newsquest.co.uk or leave a comment below.