A solicitor has been rebuked by the Solicitors Regulation Authority for losing an unencrypted USB memory device that contained confidential client information.

According to a regulatory agreement published this week, Lucy Crossman failed to realise the USB device was lost as she was on furlough from Walsh Solicitors, where she worked between October 2016 and April this year, when the device was found by a member of the public last July. 

The SRA says the USB was not encrypted and contained sensitive personal data about current and former clients. The member of the public reviewed the contents and sent the device to a firm that was mentioned in some of the documents. The firm reviewed the contents and established that the device might belong to Crossman. The firm reported the matter to the regulator.

The SRA accepted Crossman’s admissions that she failed to safeguard confidential client information retained on an unencrypted USB between January 2016 and August 2019, breaching the SRA’s code of conduct and principles.

Considering an appropriate sanction, the SRA took into account that Crossman ‘admitted her conduct in full and shown insight’.

The regulator said a written rebuke was appropriate: ‘Her conduct was reckless as to the risk of harm and her regulatory obligations. The USB storage device contained approximately 1,400 documents containing confidential information about clients and former clients, including details of minors and of clients’ criminal convictions. The USB storage device was not encrypted and could be accessed without a password.’

Crossman agreed to pay the £300 costs of the SRA’s investigation and to the regulatory agreement being published.