ICO issues more council fines

But some call into question severity of penalty for mistakenly emailed personal data.

data protection

The Information Commissioner's Office (ICO) has served monetary penalties to two local councils.

The data watchdog said yesterday it had fined Worcestershire County Council of 80,000 and North Somerset Council 60,000 for serious breaches of the Data Protection Act.

Information Commissioner, Christopher Graham, said: "I hope these penalties send a clear message to those working in the social care sector. The Information Commissioner takes this sloppiness seriously and so should you."

The Worcestershire County Council incident took place this March, where a member of staff emailed highly sensitive personal information about a large number of vulnerable people to 23 unintended recipients. The error occurred when the employee clicked on an additional contact list before sending the email, which had only been intended for internal use.

Advertisement - Article continues below
Advertisement - Article continues below

The ICO found Worcestershire had failed to take appropriate measures to guard against the unauthorised processing of personal data, such as providing employees with appropriate training and clearly distinguishing between internal and external email distribution lists. The council had also failed to properly consider an alternative means of handling the information, such as holding it in a secure system that could only be accessed by members of staff who needed to see it.

Worcestershire told the ICO that as soon as the breach occurred the council employee immediately realised their error and attempted to contact all of the unintended recipients to ensure that the information was deleted.

A North Somerset Council employee sent five emails between November and December 2010, two of which contained highly sensitive and confidential information about a child's serious case review, to the wrong NHS employee when creating a personal distribution list.

Despite the fact that the council employee was told about the error by the unintended recipient shortly after the first incident took place, information was emailed to the same NHS employee on a further three occasions before the breach was raised at a senior level.

The ICO said two of the council's assistant directors highlighted the issue with the employee on 9 December, but a fifth and final incident took place later that same day. The NHS organisation verbally confirmed to North Somerset Council that it destroyed the emails after their own internal investigation was complete.

The watchdog added that, although North Somerset Council had some policies and procedures in place, it had failed to ensure that relevant staff received appropriate data protection training. It has also recommended the council adopts a more secure means to send information electronically, including encryption and ensuring that managers sign off email distribution lists.

Advertisement - Article continues below

These were the seventh and eighth monetary penalty notices issued by the ICO, having only recently asked the government for more power to levy larger penalties.

Grant Taylor, vice president of the IT threat mitigation specialist Cryptzone, said he understood why the ICO deems it necessary to impose the fines, but questioned why the breaches happened in the first place.

"While assisting staff with the correct training and having the right security policies in place is clearly a given, protecting data in the public sector is also about using some common sense," Taylor said.

"Considering whether open or secure email is the appropriate communications medium, checking and double checking that the right recipients will receive the information and measures like encryption and data minimisation should be routine in all aspects of local government interactions," he added.

Featured Resources

Digitally perfecting the supply chain

How new technologies are being leveraged to transform the manufacturing supply chain

Download now

Three keys to maximise application migration and modernisation success

Harness the benefits that modernised applications can offer

Download now

Your enterprise cloud solutions guide

Infrastructure designed to meet your company's IT needs for next-generation cloud applications

Download now

The 3 approaches of Breach and Attack Simulation technologies

A guide to the nuances of BAS, helping you stay one step ahead of cyber criminals

Download now


data management

EU-US data transfer tools used by Facebook ruled legal

19 Dec 2019
internet security

Avast and AVG extensions pulled from Chrome

19 Dec 2019

Are you taking enough accountability on cyber security?

18 Dec 2019

Google confirms Android cameras can be hijacked to spy on you

20 Nov 2019

Most Popular

mergers and acquisitions

Xerox to nominate directors to HP's board – reports

22 Jan 2020
operating systems

17 Windows 10 problems - and how to fix them

13 Jan 2020
public sector

UK gov launches £300,000 SEN EdTech initiative

22 Jan 2020
web browser

What is HTTP error 503 and how do you fix it?

7 Jan 2020