Barnet Council fined for losing sensitive data on vulnerable

Barnet Council has been fined £70,000 for losing highly sensitive and confidential information on 15 vulnerable children and young people.

The paper records included names, addresses, dates of birth and details of sexual activities of the individuals, who were all under the care of social services.

The loss occurred when a social worker took the documents home to work on them out of hours in April last year.

The house was subsequently burgled and a laptop bag containing the papers and an encrypted computer was stolen.

An investigation by the Information Commissioner’s Office (ICO) found that the council “failed to take appropriate organisational measures against the accidental loss of personal data held on paper records”.

Although the council had an information security policy and some guidance for staff on handling sensitive papers, the measures failed to explain how the information should be kept secure.

The incident is the second time the council has found itself in trouble with the ICO.

In June 2010, an unencrypted device containing personal data was stolen from an employee’s home.

The authority subsequently introduced a paper handling policy but the most recent investigation found that was not in place at the time of the second loss.

Simon Entwisle, the ICO’s director of operations, said: “The potential for damage and distress in this case is obvious. It is therefore extremely disappointing the council had not put in place sufficient measures in time to avoid this second loss.

“Whilst we are pleased Barnet Council has now taken action to keep the personal data they use secure, it is vitally important that organisations have the correct guidance in place to keep sensitive paper records taken outside of the office safe.

“This includes storing papers containing sensitive information separately from laptops.”

A council representative said the authority was putting a new paper policy in place when the latest misdemeanor occurred and that subsequent policies have been approved by the ICO.

A statement released by the authority said: “We obviously accept the ICOs judgement but we are very disappointed that the Commissioner has fined the council in this instance.

“This data loss was the result of a criminal act where a member of staff had their house broken into and material that was under lock and key was stolen.

The ICO also accepts that it was appropriate for the member of staff to have this material at home for this period “There is no evidence that the material taken has been misused in any way.”