Council fined £100,000 after confidential social care files left in empty building

By The Press Association17th August 2016News EnglandAdult Care, Hampshire, Local Authorities, News England, Social Care

A county council has been fined £100,000 after files containing highly sensitive personal details of more than 100 people were discovered in a disused building.

Social care files were found along with 45 bags of confidential waste at Town End House in Havant, Hampshire, by the new owners of the building when it was bought in August 2014.

The forgotten documents were found to contain “highly sensitive” information about adults and children in vulnerable circumstances, according to the Information Commissioner’s Office (ICO).

Officials at the ICO, which levied the fine on Hampshire County Council, said there could have been “distressing consequences” if the data had ended up in the wrong hands.

It emerged that there was a two-year gap between agents selling the property and prospective buyers having access to it after the council’s adults’ and children’s services team had left the building.

Steve Eckersley, the ICO’s head of enforcement, said: “Thank goodness the company reported the find of personal details. If the information had ended up in the wrong hands, it could have had distressing consequences.”

ICO investigators found Hampshire County Council had failed to follow the law which states that organisations must have measures in place to guard against accidental loss or destruction of personal data.

Mr Eckersley went on: “The council knew the building had housed a department that dealt with confidential information and should have had a proper procedure in place to check no personal data was left in the building.

“Organisations must implement effective contingency plans to protect personal data when decommissioning buildings. The council’s failure to look after this information was irresponsible. It not only broke the law, but put vulnerable people at risk.”

A Hampshire County Council spokesman said: “We are very sorry that this incident occurred. Hampshire County Council takes the management and protection of its data very seriously.

“Accordingly, appropriate procedures were in place at the time, but unfortunately, on this occasion, the process was not fully adhered to. However, at no time was any information disclosed outside of the site.

“Immediate steps were taken to investigate the matter fully, and remedial action was taken. This has included strengthened and improved processes in the removal of, and destruction of, confidential waste from vacated buildings.

“We reported the incident to the ICO as soon as we became aware of it, which was at the point the company referred the incident to the county council, and have co-operated fully at all stages of the ICO’s investigation. We are currently considering the ICO’s decision.”