http://www.dailyrecord.co.uk/news/scottish-news/2012/01/30/midlothian-council-fined-140k-for-sending-reports-on-children-and-their-carers-to-the-wrong-people-86908-23727870/A COUNCIL has been handed the biggest ever fine for disclosing sensitive personal data after sending details on children and their carers to the wrong people five times last year.
The Information Commissioner's Office (ICO) fined Midlothian Council £140,000 over the breaches, which it said caused "serious upset" to the children's families.
It is the largest fine issued over such breaches by the ICO to date, and the first to an organisation in Scotland, the ICO said.
But Brighton and Sussex University Hospitals NHS Trust is contesting a possible fine of up to £375,000 after computer hard drives containing confidential information belonging to tens of thousands of patients and staff were stolen and put up for sale on eBay.
All the breaches by Midlothian Council involved children's social service reports being sent to the wrong recipients between January and June last year.
Ken Macdonald, the ICO's assistant commissioner for Scotland, said: "Information about children's care, as well as details about their health and wellbeing, is some of the most sensitive information a local authority holds.
"It is of vital importance that this information is protected and that robust policies are followed before it is disclosed.
"The serious upset that these breaches would have caused to the children's families is obvious and it is extremely concerning that this happened five times in as many months.
"I hope this penalty acts as a reminder to all organisations across Scotland and the rest of the UK to ensure that the personal information they handle is kept secure."
The ICO's investigation found that all five breaches could have been avoided if the council had put adequate data protection policies, training and checks in place.
In one case, papers relating to the status of a foster carer were sent to seven healthcare professionals, none of whom had any reason to see the information, while in another, minutes of a child protection conference were sent to the former address of a mother's partner, where they were opened and read by his ex-partner.
The papers also contained personal data about the children's mother, who made a complaint to her social worker.
The ICO added that despite an investigation into the first breach, which happened in January, starting when the breach was discovered in March, this did not prevent further incidents in both May and June.
Colin Anderson, the council's chief social work officer, said: "As soon as the council discovered the problem, it investigated and found eight letters or documents had been sent to the wrong recipients, for which the council is sincerely sorry.
"The council immediately took steps to retrieve the information, or have it destroyed, and voluntarily reported ourselves to the Information Commissioner.
"I must emphasise that there is no evidence that anyone was put at risk."
He went on: "While the council accepts there were mistakes, they were caused by human error.
"Clear procedures were in place but were not followed. Consequently a number of staff have been subject to disciplinary processes.
"In addition the council has provided further mandatory training on handling information and has further strengthened the existing procedures."
Three other alleged breaches by the council are still being investigated by the ICO, the council said.
Nick Pickles, director of the Big Brother Watch campaign group, said: "These cases are a harrowing example of what sadly happens frequently in local authorities across the country.
"Given the growing volume of personal information held by councils, their inability to properly protect our most personal details is a significant threat to personal privacy and civil liberties.
"Despite continued fines, it is clear that much more needs to be done."
He added that while fining councils was a useful deterrent, "it will be in vain if the people who fail to protect our personal information are able to escape punishment".
No one was fired over the mistakes by Midlothian Council, but it is understood that five administrative staff were disciplined, with two being moved to posts where they will no longer handle sensitive personal information.
Wrongly Accused Person is participating in 'Project Honeypot'. As such, any malicious attacks against any area of this site will be reported for inclusion in their database and may result in exclusion from many other sites and forums.
We provide this site and all associated caseblogs completely freely to those who need it. You can help and save money yourself at the same time by ordering goods through Amazon.
