ICO raps Somerset County Council after data breach

Data protection watchdog the Information Commissioner's Office (ICO) has been forced to publically reprimand yet another local authority after a data breach that exposed the personal details of a local teenager.

Somerset County Council sent a social service assessment on the teenager to the wrong family. The assessment included sensitive personal information relating to a teenager's behavioural history and medical background, according to the ICO.

The council also failed in its handling of the incident once it discovered the error, mistakenly telling the recipient of the information to throw it away in the first instance.

"The information collected by social services departments is often extremely sensitive. Local authorities should make sure they have adequate measures in place to keep this information secure, especially where there is the potential for human error," said Sally-Anne Poole, acting head of enforcement at the ICO.

"Even though the information was returned to the council the damage had already been done and will have caused considerable embarrassment to those affected."

The council's chief executive has now signed a formal understanding with the ICO to make sure staff know its policies on the storing, use and disclosure of personal data, and to implement quality control checks before any personal information is released in future.

Earlier this week the ICO released best practice guidance for public and private sector orgnisations designed to provide guidance on sharing personal information in an appropriate and legally compliant manner.