23.11.12
Plymouth fined £60,000 for social services data breach
The Information Commissioner’s Office (ICO) has fined Plymouth City Council £60,000 for sending details of a child neglect case to the wrong family.
The ICO called it a “serious breach of the Data Protection Act”, as the report included highly sensitive personal information about two parents and four children, notably allegations of child neglect resulting in ongoing care proceedings.
An investigation by the ICO found that the council had no secure system in place for printing reports containing sensitive personal data, and had failed to take reasonable steps to ensure reports were checked before they were sent out.
Stephen Eckersley, head of enforcement at the ICO, said: “It would be too easy to consider this a simple human error. The reality is that this incident happened because not enough care was being taken within the organisation when handling vulnerable people’s sensitive information. The distress this incident will have caused the people involved is obvious, and the penalty we have issued today reflects that.”
The Plymouth Herald reported that the incident, which happened in November 2011, involved a social worker who used a different printer to their normal one because of a fault, but pages from a report they were printed were picked up and sent off by a different social worker.
A woman who received some pages from the other family’s report by mistake contacted the other family via a private message on a social networking site to inform them she had the information, the newspaper reported.
Plymouth City Council said: “The breach occurred a year ago because three pages of information were collected from a printer in error together with another document. It was given to a client in an envelope by a social worker. It was later reported by the client and immediate action was taken to manage the situation.
“In line with guidance, the incident was reported to the Information Commissioner's Office. The three pages were quickly recovered and destroyed, both clients were spoken with about the incident and our sincerest apologies were offered.
“Practical steps to prevent a similar situation happening again were taken including secure pin printing so that reports are only printed when staff activate the printer with their code, which reduces the risk of papers being mixed up.
“Extra checks before sensitive documents are dispatched from the office are also being devised. Children's Social Care have reinforced to all managers and staff that all employees have personal responsibility for the confidentiality of client information and the security of documents.”
The fine was cut to £48,000 because of early payment. It is paid into the Treasury’s Consolidated Fund.
Tell us what you think – have your say below or email [email protected]