Scottish council fined for data breach

12 Sep 2012

Another hefty fine for data protection breach meted out by the ICO

The Information Commissioner’s Office (ICO) has meted out another hefty penalty for data protection infringements, this time to Scottish Borders Council (SBC), for £250,000.

Documents relating to council staff, including pensions, bank account and salary details, were dumped in a supermarket recycling bank after they had been handed over by the Council to a third-party company for digitisation. It was only when a member of the public tipped off the police about the more than 600 files was action taken.

The ICO found that SBC put no contract in place with the third-party processor, sought no guarantees on the technical and organisational security protecting the records and did not make sufficient attempts to monitor how the data was being handled.

Ken Macdonald, ICO Assistant Commissioner for Scotland, said: "This is a classic case of an organisation taking its eye off the ball when it came to outsourcing. When the Council decided to contract out the digitising of these records, they handed large volumes of confidential information to an outside company without performing sufficient checks on how securely the information would be kept, and without even putting a contract in place.

"It is only good fortune that these records were found by someone sensible enough to call the police. It is easy to imagine other circumstances where this information could have exposed people to identity fraud and possible financial loss through no fault of their own.

"If one positive can come out of this, it is that other organisations realise the importance of properly managing third parties who process personal data. The Data Protection Act is very clear where the responsibility for the security of that information remains, and what penalties await those who do not comply with the law."

Meanwhile, the Council has voiced its dismay at the fine in an official statement. Tracey Logan, chief executive of SBC, said: “It is very disappointing to receive such a high monetary penalty from the ICO especially in the current economic climate.”

“We do acknowledge the seriousness of this breach and have already taken steps to ensure data protection continues to be a priority across the council. We are fully committed to complying with the terms set out in the ICO’s undertaking,” she said, before adding that, “this additional expenditure is obviously unhelpful at a time when public funding is already stretched.”