The local government sector has already received penalties totalling over £2m in the last three years following serious failings in the way they are looking after people’s data.
The total value of these penalties is higher than for any other sector, with councils stuck in an apparent cycle of all too common mistakes. All of these breaches could have been prevented if councils had looked after people’s information correctly by complying with the Data Protection Act.
The Information Commissioner’s Office (ICO), who I work for, is responsible for helping councils look after the personal information they hold by providing support and guidance on its website and through a dedicated helpline.
The ICO also provides free audits and advisory visits to help council’s improve their practices. All of this work enables us to develop a detailed understanding of where councils are and, even more importantly, aren’t getting it right when to comes to looking after people’s information.
While not all of the information councils handle will be personal and an even smaller percentage of that will be sensitive personal data, such as information relating to an individual’s health, I see the same errors and oversights from councils across the UK.
Of the 22 penalties issued to local councils already, over half of the cases relate to information being disclosed in error. The most recent example of this relates to a penalty of £100,000 which was served by the ICO on Aberdeen city council in August. This was after the social services records of several vulnerable children were unwittingly published online and remained available for a three month period.
The error was caused by an employee who failed to recognise that a program on their second hand laptop automatically uploaded documents online. The problem was allowed to go unnoticed for several months as the council had no home working policy for its staff and had no restrictions on the downloading of sensitive information from the council’s network.
More commonly, councils have received penalties after sensitive information – often relating to individuals and children in care – is sent to the wrong person either through email, post or fax. In these cases errors have occurred due to insufficient guidance and training for staff, a clear lack of management oversight, or a failure to put any form of safeguards in place to prevent email, fax or postal addresses being entered incorrectly.
Often it is a combination of all three, resulting in multiple data breaches where the original mistake has continued to go unnoticed until one of the recipients has contacted the council to alert the relevant authority to the problem.
The use of unencrypted laptops or memory sticks to store sensitive personal data is another area of concern. Failing to encrypt the data means that the information can be accessed in a matter of minutes if the device is subsequently lost or stolen. Password protection is not enough.
The security measures an organisation adopts to protect personal information stored on a laptop or memory stick must reflect the sensitivity of the data contained on the device. When the data is sensitive data, the loss of which is liable to cause damage and distress to those affected, then encryption is a must.
Encryption is a relatively simple measure to adopt, costs relatively little to introduce and we have published a useful blog introducing the various encryption options open to councils to help them keep their data secure.
Councils must ask themselves what personal information they are processing? How sensitive is it and whether existing data protection policies and procedures are effective?
The breaches reported to us are preventable and it is up to councils to make sure they are stopping them before a serious breach occurs. Failure to do so not only leaves a council in line for a potential fine of up to £500,000, but also shows that they have failed to play their part in breaking a damaging cycle of data protection failings within the local government sector.
Dawn Monaghan is the Group Manager for the Public Services Team. Dawn’s team is responsible for engaging with and maintaining relationships with key stakeholders in the health, education and local government sectors.
[This article was first published on the Guardian Local Leaders Network]