The ICO has ordered Anglesey County Council to improve its data protection practices after it repeatedly failed to address security and privacy issues.
Two separate security incidents as far back as 2011 led to the council signing undertakings to make changes and improve practices. But despite committing to the improvements, audit visits in July 2013 and October 2014 still found unresolved problems with the security of personal data.
Anne Jones, Assistant Commissioner for Wales said: