Three Councils found in breachof the Data Protection Act

A lack of training in handling sensitive data is said to be the main cause in the latest Data Protection Breaches. Three councils including London Borough of Barnet, West Sussex County Council and Buckinghamshire County Council have all been found in breach of the Data Protection Act and as a result, over 9000 children’s data has been put at risk.

London Borough of Barnet’s breach came as a result of a theft at the home of a council employee. An unencrypted, non-password protected USB data stick and CDs containing sensitive information, which had been downloaded without authorisation, were stolen.

West Sussex County Council also had a device stolen from the home of an employee – an unencrypted laptop containing sensitive personal data. It is thought that over 2,300 unencrypted laptops are still in use by the council; however steps are now being taken to encrypt these.

An employee at Buckinghamshire County Council lost sensitive documents at Heathrow Airport. Investigations revealed that some of the council’s policies needed revision and that staff training in data protection was insufficient.

Sally-anne Poole, Enforcement Group manager at the ICO, said “These three councils have shown a poor regard for the importance of protecting children’s personal information. It is essential that councils ensure the correct preventative safeguards are in place when storing and transferring personal information, especially when it concerns sensitive information relating to children. A lack of awareness and training in data protection requirements can lead to personal information falling into the wrong hands.”

All three councils were found to be in breach of the Data Protection Act and have since signed formal undertakings to ensure staff will be made fully aware of the policies of their council for the storage and use of personal data.