Exclusive: ICO sends letter to councils demanding better data protection

Information commissioner Christopher Graham has confirmed to V3 that he has now sent a letter to all English local authorities urging them to improve their data protection policies.

V3 first revealed the letter was being drafted on Tuesday.

Graham had explained he was writing the letter, in conjunction with the head of the civil service Robert Kersale, due to concerns with councils' poor data handling after numerous authorities have been on the receiving end of fines from the Information Commissioner's Office (ICO) in recent months.

Graham confirmed on Thursday that it has now been sent.

"[The] joint letter to English local authorities from Sir Bob Kerslake and me has gone out. We'd been working on the draft," he told V3.

V3 asked to see a copy of the letter but had not received any information at the time of publication from the ICO.

Graham told V3 the letter to local government will take a similar tone to the one he wrote with NHS chief executive Sir David Nicholson to data protection officers (DPOs) in the health sector last year.

The new letter comes in the same week that the ICO issued its largest fine to date, with Midlothian Council facing a £140,000 penalty for sending documents on children and their carers to the wrong recipients on five separate occasions.

This followed on from huge fines for Powys Council (£130,000), Surrey County Council (£120,000), Hertfordshire County Council (£100,000), Worcestershire County Council (£80,000), Ealing Councuil (£80,000), Hounslow Council (£70,000) and North Somerset Council (£60,000).

The ICO has also written to the Ministry of Justice (MoJ) requesting the power to carry out non-consensual audits of public authorities, including NHS bodies.