ICO Fines Council £90k After Children’s Data Disclosed

Telford and Wrekin Council has been hit with a £90,000 fine, as the Information Commissioner’s Office (ICO) shows its teeth yet again.

The council was guilty of two data breaches. The first came when a member of staff working in Safeguarding Services sent the Social Care Core Assessment of one child to the child’s sibling instead of their mother. The assessment also contained the name and address, date of birth and ethnicity of another child who had made “a serious allegation” against one of the other children, according to the ICO.

The second breach happened when names and addresses of foster care placements of two young children were mistakenly placed in their Placement Information Record (PIR). Without anyone checking it, the  PIR was shown to the children’s mother who noticed the snafu.

A serious case

“The decision by the ICO to issue a penalty in this case reflects its seriousness – these were two very similar data breaches which occurred within a short space of time, and both involved highly confidential and sensitive personal data,” said the ICO’s deputy commissioner David Smith.

“Most importantly, some of the people affected were vulnerable children, two of whom had to be moved to a new foster home as a result of the second data breach. It is the responsibility of all organisations – especially where children or other vulnerable people are involved – to keep sensitive personal data secure.”

The fine came just a week after the ICO issued its biggest ever monetary penalty. The data protection watchdog hit the  Brighton and Sussex University Hospitals NHS Trust with a £325,000 penalty after hard drives containing patient data were put up for sale on eBay.

However, the Trust is to appeal the decision, saying it could not afford to pay the fine.

Last month saw the Central London Community Healthcare (CLCH) NHS Trust tell TechWeekEurope it planned to appeal the £90,000 fine it was issued by the ICO.

Are you a security pro? Try our quiz!