Scottish Borders Council £250K data fine case goes to appeal tribunal as local authority is ranked 'worst' for data handling violations in entire UK

Scottish Borders Council was recently fined £250K for data breaches. SOUTH OF SCOTLAND local authority Scottish Borders Council (SBC) have been ranked the most unsafe local authority for data handling & security in the entire United Kingdom in terms of fines imposed by the Information Commissioner, putting SBC at the top of the list with a fine of TWO HUNDRED & FIFTY THOUSAND POUNDS.

The information was revealed in a Freedom of Information request made to the Information Commissioner’s Office detailing figures of 158 self-reported security breaches in the space of about 18 months, which local transparency campaigners claim renders many local authorities including SBC unfit for purpose while Council taxpayers are having to pay heavily for the carelessness of councillors and highly paid officials who seem to dodge accountability at every turn

Scottish Law Reporter recently reported on further developments in the case of the fine imposed on Scottish Borders Council, who have since appealed the ICO fine even though the Council agreed to pay £200,000 to the ICO late last year as a ‘discounted fine’ for its breach of the Data Protection Act. It was further revealed in our report that Scottish Borders Council will also face costs of up to £150K whether it wins or loses the appeal to the ICO over the fine.

BBC NEWS has also reported on the case, which is now going to a three panel judge hearing to be held between 20 and 22 March in Edinburgh or the Borders.

Legal experts are however predicting Scottish Borders Council will lose its appeal and deservedly so, as there appears no doubt the data breaches did occur and local authorities like all others must be made to comply with the law.

Information contained in the FOI release by the Information Commissioner stated :

1. There have been a total of 158 self-reported security breaches brought to our attention by local authorities.

2. The fines which can be issued by the ICO against any data controller for a breach of the Data Protection Act 1998 and Privacy and Electronic Communications (EC Directive) Regulations 2003 are known as monetary penalty notices (MPN’s).  Details of all MPN’s which have been issued by the ICO since our powers to issue fines came into effect are published on our website.  However, for the sake of clarity we can confirm the following MPN’s have been issued against local authorities:
 
11 September 2012 – Scottish Borders Council (£250,000)
6 June 2012 – Telford & Wrekin Council (£150,000)
15 May 2012 – London Borough of Barnet (£70,000)
14 March 2012 – Cheshire East Council (£80,000)
13 February 2012 – Croydon Council (£100,000)
13 February 2012 – Norfolk County Council (£80,000)
30 January 2012 – Midlothian Council (£140,000)
6 December 2011 – Powys County Council (£130,000)
28 November 2011 – North Somerset Council (£60,000)
28 November 2011 – Worcestershire County Council (£50,000)
9 June 2011 – Surrey County Council (£120,000)
8 February 2011 – Ealing Council (£80,000)
8 February 2011 – Hounslow Council (£70,000)

3.  The nature of the breaches have been recorded as follows (please note that from 1 April 2012 we have changed the way in which have recorded the nature of the breach/incident, hence we have provided two tables):

Pre April 2012: Disclosed in error - 50 Lost data/hardware – 8, Lost in transit – 5, Non-secure disposal – 2, Other – 6, Stolen data/hardware – 17, Technical/procedural failure – 4.

Post April 2012: Disclosed in error – 36, Lost or stolen hardware – 4, Lost in transit – 1, Lost or stolen paperwork – 10, Non-secure disposal of paperwork – 1, Other – non principle 7 incident – 1, Technical security failing (including hacking) – 2, Still awaiting classification - 1

‘Public relations disaster’ & £150K costs loom for Scottish Borders Council over appeal of ICO £250K data breach fine

Scottish Borders Council face defeat & significant costs over their appeal against £250K ICO fine Scottish Borders Council, the regularly mired-in-scandal South of Scotland local authority which recently hit the headlines over its secretive treatment of a huge payout of £318,000 to former Chief Executive David Hume may be about to suffer another mishap, as it appears the Council is now about to lose its appeal against a £250,000 fine imposed by the Information Commissioner even though SBC had already agreed to pay £200,000 to the ICO in a ‘discounted fine’ for its breach of the Data Protection Act. The Council will also face costs of up to £150K whether it wins or loses the appeal to the ICO over the fine.

According to a report about the fine imposed on Scottish Borders Council by the ICO on Outlaw.com, an Information Rights Tribunal is to rule on whether organisations can pay a discounted fine for breaching UK data protection laws and still keep the right to appeal against the penalty.

However, in a statement reported on the Outlaw.com website, the Information Commissioner’s Office (ICO) has said that the fact the Council has paid the discounted penalty means the body has lost its right to appeal.

“The Commissioner operates an early payment scheme for all civil monetary penalties served,” an ICO spokesperson said in a statement. “Under that scheme, a data controller who has been subject to a penalty may obtain a 20% discount if the Commissioner receives the full payment of the penalty within 28 calendar days of the notice being served.”

“The objectives of the early payment scheme are to encourage early payment of the penalties and reduce the costs to the public purse entailed on pursuing enforcement action and responding to challenges to the notices. The scheme operated by the Commissioner is similar to that operated by other regulators, such as the Financial Services Authority,” the spokesperson added. “There is no provision under the scheme which allows a data controller to make a payment subject to reservations, for example, by reserving his right to appeal against the penalty. The effect of such reservations would be to nullify the advantages which the scheme is intended to achieve.”

Yet, an earlier Press Release from Scottish Borders Council, dated 22 October 2012 : Council appeals data breach penalty, reprinted below, claimed the discounted fine was only paid “with the caveat that SBC still reserved the right to appeal.”

Scottish Borders Council has launched an appeal over the size of a penalty from the Information Commissioner's Office (ICO) after a self-reported data breach. The ICO issued a £250,000 fine to SBC last month after files relating to the Council were discovered in a recycling bank.

The fine has been paid in order to achieve a 20% discount on the total amount but this was done so with the caveat that SBC still reserved the right to appeal. The appeal has been lodged in a written submission to the Information Tribunal.

The ICO has until 2 November to file a reply to the appeal. The case will then go to a three-judge panel for a decision, which is expected by the end of January.

Legal insiders have told Scottish Law Reporter “there is little legal basis for the claims made in the Council’s October Press Release”, and expect the local authority to lose its appeal.

Hawktalk, the blog of Amberhawk Training Ltd, has featured an in depth report on the ICO’s £250K fine of Scottish Borders Council,and sets out in some detail the costs of losses facing SBC if it loses its appeal. It is claimed there could be a public relations disaster for the Council if it’s appeal to the Information Rights Tribunal goes wrong.

Hawktalk reports that the Information Rights Tribunal could reinstate the full amount of the fine imposed by the ICO on the council which would result in SBC losing a further £50,000 and would also have to bear the costs of its appeal, thought to be around £80,000 to £100,000 and that even if the Council won its appeal, it would still have to bear its own costs.

Scottish Law Reporter featured a report on the £250K fine of Scottish Borders Council in an earlier article, HERE which also featured claims from Council insiders of “widespread abuse of data protection legislation within the council”.

No one from Scottish Borders Council was available for comment.

Data abuse ‘has gone on for years’ say insiders as Scottish Borders Council fined £250K after pension records found in car park recycle bin

Scottish Borders Council has been issued a substantial fine by the Information Commissioner Scottish Borders Council, the south of Scotland local authority which finds itself in £262 Million worth of debt after years of abusing public finances, has been issued a £250,000 fine by the Information Commissioner's Office after records of staff pensions were found in a paper recycle bank located in a supermarket car park.

While the ICO’s fine relates to the single breach reported in it’s Press Release, SBC insiders have privately acknowledged there is “widespread abuse of data protection legislation within the council”.

The ICO Press Release :

Council fined £250,000 after employee records found in supermarket car park recycle bin

A Council whose former employees’ pension records were found in an over-filled paper recycle bank in a supermarket car park have been fined £250,000 for the data breach.

Scottish Borders Council employed an outside company to digitise the records, but failed to seek appropriate guarantees on how the personal data would be kept secure.

That prompted the Information Commissioner to use his powers under the Data Protection Act to impose a Civil Monetary Penalty of £250,000 on the Council.

The Data Protection Act requires that, if you decide to use another organisation to process personal data for you, you remain legally responsible for the security of the data and for protecting the rights of the individuals whose data is being processed.

But Scottish Borders Council put no contract in place with the third party processor, sought no guarantees on the technical and organisational security protecting the records and did not make sufficient attempts to monitor how the data was being handled.

It is believed more than 600 files were deposited at the recycle bins, containing confidential information and, in a significant number of cases, salary and bank account details. The files were spotted by a member of the public who called police, prompting the recovery of 676 files. A further 172 files deposited on the same day but at a different paper recycling bank are thought to have been destroyed in the recycling process.

Ken Macdonald, ICO Assistant Commissioner for Scotland, said: “This is a classic case of an organisation taking its eye off the ball when it came to outsourcing. When the Council decided to contract out the digitising of these records, they handed large volumes of confidential information to an outside company without performing sufficient checks on how securely the information would be kept, and without even putting a contract in place.

“It is only good fortune that these records were found by someone sensible enough to call the police. It is easy to imagine other circumstances where this information could have exposed people to identity fraud and possible financial loss through no fault of their own.

“If one positive can come out of this, it is that other organisations realise the importance of properly managing third parties who process personal data. The Data Protection Act is very clear where the responsibility for the security of that information remains, and what penalties await those who do not comply with the law.”

For practical advice on this topic, read the ICO's guidance 'Outsourcing: A guide for small and medium-sized businesses'

Businesses can follow these top tips to make sure they keep personal data safe when outsourcing:

• Always select a reputable organisation to work with
• Make sure the organisation has appropriate data security measures in place, including how it disposes of data
• And make sure the organisation has appropriate security checks on staff too
• Put a clear, enforceable contract in place
• Make sure that contract requires the contractor to report any security breaches or other problems to you, and have procedures in place on how you will act if problems are reported
• If you are going to transfer personal data outside of the European Economic Area, make sure you’re doing so in line with Data Protection Act 1998.

Scottish Government’s lawyer Ruth Crawford QC breached Data Protection Act over theft of her unsecured laptop full of patient’s personal details

RUTH CRAWFORD QC, an Advocate from the Axiom Advocates stable who works for the Scottish Government has been slapped on the wrist by the Information Commissioner’s office after her unencrypted laptop was stolen while she was away on holiday. Ms Crawford regularly advises & represents the the Scottish Government in litigation and also works for local authorities and other public bodies.

The incident of the stolen laptop which was full of the details of patients involved in medical cases was DELIBERATELY NOT reported to the ICO's office until all the cases had finished, causing the ICO to issue an assurance to the legal profession that all data breaches reported to its office would not be disclosed and that all such breaches should be reported immediately (According to some, delays in reporting potential crimes sound fishy - Ed).

The laptop was never recovered however it has been claimed “most of the information compromised would already have been released as evidence in court papers” which would probably rank as a world first for a case where counsel for either side spilled the lot in court! (Do people still fall for these kinds of explanations ? – Ed)

The ICO reports :

Advocate’s legal files lost after unencrypted laptop theft

A Scottish advocate breached the Data Protection Act after failing to encrypt a laptop containing sensitive personal data which was later stolen, the Information Commissioner’s Office (ICO) said today.

The laptop was stolen from the home of Ruth Crawford QC whose clients include the Scottish Government and NHS Scotland in 2009 when she was away on holiday. It contained personal data relating to a number of individuals involved in eight court cases the advocate had been working on. This included some details relating to the physical and mental health of individuals involved in two of the cases. The device has not been recovered; however, most of the information compromised would already have been released as evidence in court papers.

The breach was only reported to the ICO on 30 August 2011 when the last case relating to information held on the laptop was concluded. The ICO’s enquiries found that, whilst Ms Crawford had some physical security measures in place at the time of the theft, she failed to ensure that either the device or the sensitive information stored on it was appropriately encrypted.

The QC has now agreed to put the necessary changes in place to ensure this type of incident does not happen again. This includes locking away any personal information stored at her home and following any future data protection guidance issued by the Faculty of Advocates or her stable.

Ken Macdonald, Assistant Commissioner for Scotland said: “The legal profession holds some of the most sensitive information available. It is therefore vital that adequate security measures are in place to keep information secure.”

“As this incident took place before the 6 April 2010 the ICO is unable to serve a financial penalty in this instance. But this case should act as a warning to other legal professionals that their failure to protect personal information is not just about potentially being served with a penalty of up to £500,000 – it could affect their careers too. If confidential information is made public, it could also jeopardise the important work they do in court.

“The ICO would also like to assure the legal profession that any information reported to this office will not be disclosed unless there is specific legal authority for us to do so. Therefore all breaches should be reported to our office as soon as practically possible.”

The undertaking by Ms Crawford QC, issued after a deal was apparently struck for the ICO not to issue a fine or use its powers, states :

The Information Commissioner (the ‘Commissioner’) was informed on 30 August 2011 of the theft, in summer 2009, of an unencrypted laptop from the study of the data controller’s home. The laptop, which was not encrypted, contained sensitive personal data relating to a number of individuals who were involved in cases on which the data controller was instructed to act. It is likely that much of the data compromised by this incident would have already been in the public domain.

The theft occurred while the data controller was on holiday, having left plumbers to fit a new boiler at her home. The data controller provided the plumbers with keys and the code to her alarm. She highlighted the importance of keeping her front door locked and of activating the alarm when leaving the house. Upon returning from holiday on 3 September 2009, the data controller discovered that the laptop and a purse were missing from her study. She subsequently reported the matter to the police.

The Commissioner has noted that physical security measures were in place at the time of the incident, but that there was insufficient technical security employed on the laptop to protect the data.

The Commissioner has considered the data controller’s compliance with the provisions of the Act in the light of this matter. The relevant provision of the Act is the Seventh Data Protection Principle. This Principle is set out in Schedule 1 Part I to the Act. The Commissioner has also considered the fact that some of the data stolen in this incident consisted of information as to the physical or mental health or condition of the data subjects. Personal data containing such information is defined as ‘sensitive personal data’ under section 2(e) of the Act.

Following consideration of the remedial action that has been taken by the data controller, it is agreed that in consideration of the Commissioner not exercising his powers to serve an Enforcement Notice under section 40 of the Act, the data controller undertakes as follows:

The data controller shall, as from the date of this Undertaking and for so long as similar standards are required by the Act or other successor legislation, ensure that personal data are processed in accordance with the Seventh Data Protection Principle in Part I of Schedule 1 to the Act, and in particular that:

(1) Portable and mobile devices including laptops and other portable media used to store and transmit personal data, the loss of which could cause damage or distress to individuals, are encrypted by 31 December 2011;

(2) If personal data is to be stored overnight, other than securely within the data controller’s place of work, it shall be kept in a secure, locked storage place;

(3) The data controller shall subscribe to any information security policies and procedures as and when they are implemented by the Faculty of Advocates or her stable, and take all appropriate steps to comply with these at all times;

(4) The data controller shall implement such other security measures as she deems appropriate to ensure that personal data is protected against unauthorised and unlawful processing, accidental loss, destruction, and/or damage.