Cabinet Office minister Oliver Letwin broke the law when he dumped sensitive official documents in a park bin, a watchdog found today.
Information Commissioner Christopher Graham issued a stern warning to the Conservative MP today that he faces formal enforcement action if he continues to carelessly throw away letters and papers.
Mr Letwin has now signed a written commitment pledging to dispose of his files in a secure manner.
Mr Graham said: "Constituents entrust their Member of Parliament with all sorts of personal information and should never expect the details of the concerns they've raised in confidence to end up in a park bin for anyone to see.
"It is clear that Mr Letwin has learned from this incident and we're pleased that he has co-operated fully.
"It is fortunate that most of the information he discarded was not of a particularly sensitive nature and was therefore unlikely to cause substantial distress to his constituents.
"But if we receive any further reports or complaints about Mr Letwin's conduct in this area then we will consider taking more formal action. I'm sure this case will also prompt other MPs to review their handling of personal data to ensure they're doing all they can to keep it secure."
Mr Letwin apologised last month after it emerged he had disposed of papers in a bin at St James's Park, near Downing Street, on five separate occasions.
He was photographed by the Daily Mirror, which claimed the West Dorset MP had dumped more than 100 papers dating from July 2010 to September 2011, including documents containing constituents' private details and five Intelligence and Security Committee (ISC) letters.
In one, MP Andrew Tyrie reportedly tells ISC chairman Sir Malcolm Rifkind that the committee "failed to get to the truth on UK involvement in rendition".
Another discarded document was said to refer to al Qaida links to Pakistan.
At the time Downing Street admitted that the behaviour had not been "sensible" - but also stressed that none of the information was classified.
The Commissioner found that letters and emails contained the names, addresses and contact details of approximately 20 individuals. One email also included details relating to an individual's recent hospital treatment.
In an undertaking published today, the Commissioner ruled that Mr Letwin had breached the Data Protection Act.
A spokesman for Mr Letwin said: "Mr Letwin has signed an undertaking with the Information Commissioner's Office and will dispose of documents containing personal data in a secure manner.
"He has apologised to affected constituents."