Herts County Council fined £100K for data leak
PUBLISHED: 12:05 24 November 2010
FAXING highly sensitive personal information to the wrong recipients has landed the county council with a £100,000 fine.
The Information Commissioner served the financial penalty on Hertfordshire county council following two serious incidents of misdirected information, the first involving child sexual abuse and before the courts and the second referring to details of care proceedings.
The breaches of the Data Protection Act occurred in June when employees in the council’s childcare litigation unit accidentally sent the faxes to the wrong recipients on two separate occasions.
The first was meant for barristers’ chambers and was sent to a member of the public. The council subsequently obtained a court injunction prohibiting any disclosure of the facts of the court case or circumstances of the data breach.
Thirteen days later, the second misdirected fax was sent containing information relating to the care proceedings of three children, the previous convictions of two individuals, domestic violence records and care professionals’ opinions.
The fax was mistakenly sent to barristers’ chambers unconnected with the case although the intended recipient was Watford County Court.
The Commissioner, Christopher Graham, ruled that a penalty of £100,000 was appropriate given that the council’s procedures failed to stop two serious breaches taking place where access to the data could have caused substantial damage and distress.
After the first breach occurred, the council did not take sufficient steps to reduce the likelihood of another breach occurring.
Mr Graham said: “It is difficult to imagine information more sensitive than that relating to a child sex abuse case. I am concerned at this breach - not least because the local authority allowed it to happen twice within two weeks.”
Chris White, leader of the county’s Lib Dem opposition group, said: “It is not as though this was one-off incompetence; it happened twice and the council failed to take proper action over the first occasion.”
In a statement, the county council said it was sorry that the mistakes had happened and processes were in place to try and prevent any recurrence.