ICO issues more council fines

But some call into question severity of penalty for mistakenly emailed personal data.

data protection

The Information Commissioner's Office (ICO) has served monetary penalties to two local councils.

The data watchdog said yesterday it had fined Worcestershire County Council of 80,000 and North Somerset Council 60,000 for serious breaches of the Data Protection Act.

Information Commissioner, Christopher Graham, said: "I hope these penalties send a clear message to those working in the social care sector. The Information Commissioner takes this sloppiness seriously and so should you."

Advertisement - Article continues below

The Worcestershire County Council incident took place this March, where a member of staff emailed highly sensitive personal information about a large number of vulnerable people to 23 unintended recipients. The error occurred when the employee clicked on an additional contact list before sending the email, which had only been intended for internal use.

The ICO found Worcestershire had failed to take appropriate measures to guard against the unauthorised processing of personal data, such as providing employees with appropriate training and clearly distinguishing between internal and external email distribution lists. The council had also failed to properly consider an alternative means of handling the information, such as holding it in a secure system that could only be accessed by members of staff who needed to see it.

Worcestershire told the ICO that as soon as the breach occurred the council employee immediately realised their error and attempted to contact all of the unintended recipients to ensure that the information was deleted.

Advertisement - Article continues below
Advertisement - Article continues below

A North Somerset Council employee sent five emails between November and December 2010, two of which contained highly sensitive and confidential information about a child's serious case review, to the wrong NHS employee when creating a personal distribution list.

Despite the fact that the council employee was told about the error by the unintended recipient shortly after the first incident took place, information was emailed to the same NHS employee on a further three occasions before the breach was raised at a senior level.

The ICO said two of the council's assistant directors highlighted the issue with the employee on 9 December, but a fifth and final incident took place later that same day. The NHS organisation verbally confirmed to North Somerset Council that it destroyed the emails after their own internal investigation was complete.

The watchdog added that, although North Somerset Council had some policies and procedures in place, it had failed to ensure that relevant staff received appropriate data protection training. It has also recommended the council adopts a more secure means to send information electronically, including encryption and ensuring that managers sign off email distribution lists.

Advertisement - Article continues below

These were the seventh and eighth monetary penalty notices issued by the ICO, having only recently asked the government for more power to levy larger penalties.

Grant Taylor, vice president of the IT threat mitigation specialist Cryptzone, said he understood why the ICO deems it necessary to impose the fines, but questioned why the breaches happened in the first place.

"While assisting staff with the correct training and having the right security policies in place is clearly a given, protecting data in the public sector is also about using some common sense," Taylor said.

"Considering whether open or secure email is the appropriate communications medium, checking and double checking that the right recipients will receive the information and measures like encryption and data minimisation should be routine in all aspects of local government interactions," he added.

Featured Resources

Navigating the new normal: A fast guide to remote working

A smooth transition will support operations for years to come

Download now

Putting a spotlight on cyber security

An examination of the current cyber security landscape

Download now

The economics of infrastructure scalability

Find the most cost-effective and least risky way to scale

Download now

IT operations overload hinders digital transformation

Clearing the path towards a modernised system of agreement

Download now



University of California gets fleeced by hackers for $1.14 million

30 Jun 2020
cyber security

Australia announces $1.35 billion investment in cyber security

30 Jun 2020
cloud security

CSA and ISSA form cyber security partnership

30 Jun 2020
Policy & legislation

Senators propose a bill aimed at ending warrant-proof encryption

24 Jun 2020

Most Popular


How to find RAM speed, size and type

24 Jun 2020

Microsoft releases urgent patch for high-risk Windows 10 flaws

1 Jul 2020
data protection

EU institutions told to avoid Microsoft software after licence spat

3 Jul 2020