ICO slams Scottish council for publishing salary details of 900 staff online

The Information Commissioner's Office (ICO) has slammed Dumfries and Galloway Council for accidentally posting sensitive information on 900 current and former employees on its web site.

The information included staff names, salary details and dates of birth, and was mistakenly published as part of a Freedom of Information (FoI) release.

The details were left online for over two months between March and June 2011 and only removed after the council received complaints from some of the individuals affected.

The assistant commissioner for Scotland at the ICO, Ken Macdonald, said the case underlined the vital need for organisations to ensure data on staff is never put at risk.

"Being open about council pay is a fundamental way that citizens can hold local authorities to account, but that should never be at the expense of upholding individuals' privacy rights," he said.

"Procedures clearly went wrong in this case and I'm pleased that the council is reviewing its practices in light of the lessons that have been learned."

As a result of the incident, the council has commissioned an external audit of its procedures for responding to information requests and said it will respond to any concerns raised in the report when it is published in January next year.

The incident is the latest in a long line of data protection blunders by public sector authorities and comes as the ICO calls for the power to hold compulsory audits of organisations' data protection practices.

The ICO's deputy commissioner, David Smith, also recently revealed that the organisation is preparing to issue more fines in the coming months, with the public sector again set to bear the brunt of the penalties.