Scottish Borders Council has been slapped with a £250,000 fine from the Information Commissioner's Office, after staff salary and bank account details were dumped in a supermarket recycling bin.
The council had employed a third party to digitise some of its staff records, but failed to stipulate how the information should be secured.
As a result, more than 600 files, containing confidential information including banking details, are thought to have been deposited in recycling bins. The practice only came to light when a member of the public alerted the police.
"This is a classic case of an organisation taking its eye off the ball when it came to outsourcing,” said Ken Macdonald, ICO assistant commissioner for Scotland.
Many of the files were recovered by police, while some are thought to have been destroyed in the recycling process.
The ICO added that the rules on data protection were clear that organisations were responsible for the security of any personal data they hand over to third parties, and are expected to put appropriate safeguards in place.
The maximum fine that the ICO could have issued for the offence is £500,000. Scottish Borders Council will have the fine reduced to £200,000 if it pays by 11 October.
US space agency believes the crater could have preserved ancient organic molecules from the water that flowed there billions of years ago
Valve quietly closes down hardware initiatives launched following Windows 8
Scientists create a virtual reality simulation of a black hole sitting at the centre of the Milky Way
Simulations like this can help people understand complicated systems in the universe in a better way
The most luminous galaxy ever discovered is cannibalising at least three of its smaller neighbours, study finds
The galaxy radiates at 350 trillion times the luminosity of the Sun