British privacy office fines three councils in two days

By on
British privacy office fines three councils in two days

Council fined $118,000 for email bungle.

A local council in Britain has been slapped with an $A118,000 fine marking the third to be fined in two days following a series of privacy bungles last year.

The British Information Commissioner's Office (ICO) fined Cheshire East Council £80,000 ($A118,000) after an email with sensitive details was sent to the wrong person.

It followed two ICO fines to Croydon Council for £100,000 ($A147,000) and Norfolk County Council for £80,000 for separate cases of lost personal details.

According to the ICO, the "serious" breach of the British Data Protection Act occurred in May 2011 when a council employee was asked to alert local voluntary workers to a police force's concerns about an individual who was working in the area.

However, instead of sending an email via the council's secure system, the employee sent it to the local voluntary sector co-ordinator via her personal email account as the co-ordinator did not have access to the secure system.

The email contained the name and an alleged alias for the individual as well as information about the concerns British police had about him. This was forwarded by the co-ordinator to 100 intended recipients.

Also, as the email did not have any clear markings or advice on how it was to be treated, the recipients interpreted the wording of the message to mean that they too should forward the email to other voluntary workers. This meant that the email was sent to 180 unintended recipients; an attempt to recall the email led to 57 per cent of the recipients confirming that they had deleted the information.

Stephen Eckersley, head of enforcement at the ICO, said: “While we appreciate that it is vitally important for genuine concerns about individuals working in the voluntary sector to be circulated to relevant parties, a robust system must be put in place to ensure that information is appropriately managed and carefully disclosed.

“Cheshire East Council also failed to provide this particular employee with adequate data-protection training. The highly sensitive nature of the information and the need to restrict its circulation should have been made clear to all recipients.”

This article originally appeared at scmagazineuk.com

Copyright © SC Magazine, UK edition
Tags:

Most Read Articles

You must be a registered member of iTnews to post a comment.
| Register

Poll

How should the costs of Australia's piracy scheme be split?
Rights holders should foot the whole bill
50/50
ISPs should foot the whole bill
Government should chip in a bit
Other
Flash is heading towards its grave, and that's...
Great! Good riddance
Sad! Flash had some good qualities
Irrelevant. I don't care
What's Flash?
View poll archive

Whitepapers from our sponsors

What will the stadium of the future look like?
What will the stadium of the future look like?
New technology adoption is pushing enterprise networks to breaking point
New technology adoption is pushing enterprise networks to breaking point
Gartner names IBM a 'Leader' for Disaster Recovery as a Service
Gartner names IBM a 'Leader' for Disaster Recovery as a Service
The next era of business continuity: Are you ready for an always-on world?
The next era of business continuity: Are you ready for an always-on world?

Log In

Username:
Password:
|  Forgot your password?