Hertfordshire council fined after child sex abuse data breach

http://www.guardian.co.uk/technology/2010/nov/24/hertfordshire-council-child-sex-abuse-data
Hertfordshire council fined after child sex abuse data breach
• Josh Halliday
• guardian.co.uk, Wednesday 24 November 2010 11.04 GMT
Council faxed details of abuse cases to wrong recipient twice in two weeks in 'serious breach' of Data Protection Act
Breaches of data protection can carry fines of up to £500,000 under new powers given to the Information Commissioner's Office. Photograph: Corbis
Hertfordshire county council was today fined £100,000 for faxing details about child sex abuse cases to the wrong recipients on two occasions.
The council committed a "serious breach" of the Data Protection Act in June when it accidentally faxed "highly sensitive" information about child sex abuse cases to a member of the public, the Information Commissioner's Office (ICO) ruled today.
Employment services company A4e was also today fined £60,000 by the ICO for losing an unencrypted laptop in June. The fines are the first issued by the ICO since it was given the power to issue financial penalties of up to £500,000 in April.
Thirteen days after the initial data breach, Hertfordshire council sent details of three children in its care, along with the previous convictions of two individuals and domestic violence records to a barristers' firm unconnected with any of the cases. Both breaches were reported to the ICO at the time.
"It is difficult to imagine information more sensitive than that relating to a child sex abuse case," Christopher Graham, the information commissioner, said. "I am concerned at this breach – not least because the local authority allowed it to happen twice within two weeks."
Hertfordshire council today apologised and said that it would ensure the mistakes made did not happen again.
The stolen A4e laptop contained sensitive details about income levels, criminal activity and employment status of around 24,000 people in Hull and Leicester. Sheffield-based A4e reported the breach to the ICO at the time.
Graham said A4e's breach was less shocking, but added: "[It] warranted nothing less than a monetary penalty as thousands of people's privacy was potentially compromised by the company's failure to take the simple step of encrypting the data."
Andrew Dutton, the A4e chief executive, said the breach "occurred as a result of a breach of our security procedures" and that it came at a time when the company was introducing new security measures. "We have apologised for any distress caused to those involved in this one-off incident in Hull and Leicester and we do so again," he added.
Commenting on the ICO's first use of its powers to fine offenders for Data Protection Act breaches, Graham said: "These first monetary penalties send a strong message to all organisations handling personal information. Get it wrong and you do substantial harm to individuals and the reputation of your business. You could also be fined up to half a million pounds."
Stoke-on-Trent city council escaped a fine earlier this week following the loss of a USB memory stick containing unencrypted sensitive personal information about 40 children in its care.
The council escaped a financial penalty due to the incident occurring before the ICO was given the power to levy fines