The Information Commissioner's Office (ICO) has slapped West Dumbartonshire Council with an enforcement notice, but no fine, after it lost sensitive data despite being told repeatedly by the ICO to train staff on data protection.
An audit of the council by the ICO in January 2013 urged improvements to data protection and staff training, particularly with regard to home working. A follow-up in November 2013 found some improvement, but not all training had been implemented.
Then, in June 2014, an employee took some work home on a laptop containing information on an adoption case and left it in a car. The laptop was subsequently stolen.
However, the ICO stopped short of fining the council. Ken Macdonald, assistant information commissioner for Scotland, explained that the enforcement notice should serve as sufficient warning.
“Time and time again we have told this council to make these changes, and yet they have still not completed everything we set out. We’ve been left with no choice but to issue this formal notice requiring them to act," he said.
“Let’s be clear: what we’re asking for here is a basic requirement for an organisation that is trusted with large amounts of local people’s personal data. When people in Dumbartonshire provide the council with their details, they expect that staff are trained to handle this information properly.
"Unfortunately, more than three years after this was made clear to the council, this still hasn’t happened.”
The council now has to ensure that within six months it has: a mandatory data protection training programme for all staff (including new starters) and refresher training on an annual basis; properly documented and monitored training to ensure its timely completion; and a home-working policy implemented to provide sufficient guidance for staff working remotely.
No doubt other councils that have been fined by the ICO will wonder why West Dumbartonshire Council avoided a similar fate.
Mark Vartanyan was working for Norwegian e-healthcare firm Dignio when he was arrested
Samsung can't see a way to profitably compete against Amazon and Google
Fix being rushed out - but not quite as quickly as an ambulance to an emergency
Massive miner Rio Tinto claims 20 per cent of pit-to-port train kilometres in Australia are now driverless
Rio Tinto today, TfL tomorrow?