21.03.17
Norfolk CC fined £60k for sending files to second-hand shop
A county council has been fined £60,000 by the Information Commissioner’s Office (ICO) after files containing sensitive information about children was left in a cabinet which donated to a second-hand shop.
The regulator was alerted to the mishap by Norfolk County Council after a member of the public found a bundle of social work case files, which held information relating to seven children, inside their newly purchased cabinet – and, luckily, immediately alerted the authority to the error.
Steve Eckersley, head of enforcement at ICO, sharply criticised the council for the error, saying that better procedures should’ve been in place to prevent such a mistake from happening.
“The council had disposed of some furniture as part of an office move but had failed to ensure that the cabinets were empty before disposal,” said Eckersley.
“Councils have a duty to look after any personal information they hold, all the more so when highly sensitive information is concerned. In particular, about adults and children in vulnerable circumstances.”
Eckersley went on to say that Norfolk County Council had overlooked the need to ensure it had robust measures in place to protect sensitive information “for no good reason”.
“It should have had a written procedure in place which made it clear that any storage items removed from the office which may have contained personal were thoroughly checked before disposal” he added.
The news comes on the same day that councils were urged to improve data protection practices to comply with the General Data Protection Regulation (GDPR), as the ICO found that only a quarter of councils had a data protection officer in place to look after sensitive data.
The GDPR is being introduced to improve the safety of sensitive data. Last year, Aberdeen City Council and a Nottinghamshire council both experienced security breaches, whilst an ICO audit of Redbridge Council in February also found shortfalls in its data protection practices.
Norfolk County Council has now apologised for the mix-up, saying it was working to address the security issues following the files being misplaced.
Simon George, executive director for finance and commercial services at the local authority, said: “We want to reassure residents that we have robust data protection procedures and have tightened practice in the light of the case published today.
“As a council we take data protection very seriously and we are very sorry that our practice fell short on this occasion.”
George added that the council accepted the ICO’s ruling and fine, while expressing the local authority’s gratitude to the member of the public who handed the files in.
“We voluntarily reported ourselves to the Information Commissioner and we undertook a careful review to ensure that we could learn from what happened,” he said. “In the three years since this occurred, we have taken strong and effective action to ensure it is not repeated. This has included introducing robust procedures for office moves and training to ensure that our staff are aware of these procedures.”
The county council’s staff are now receiving mandatory rolling training to ensure they understand their overall data protection responsibilities, George stated, saying that a recent voluntary ICO audit gave Norfolk County Council the second highest rating for records management and training and awareness.
He concluded: “We handle a huge amount of personal data every day and incidents such as this are rare but we will continue to monitor and review practice to ensure that the personal data we hold is kept safe.”
Have you got a story to tell? Would you like to become a PSE columnist? If so, click here.