Sensitive Data Stolen From Social Worker
Leics County Council breach Data Protection Act after briefcase taken in burglary.
Capital's been told that Leicestershire County County have breached the Data Protection Act - after a briefcase with sensitive personal information was stolen from the home of a social worker.
That from the Information Commissioner's Office.
It was taken during a burglary last year - there were details about neglect; requesting for children to be taken away from their parents care.
The social worker had asked for permission to take the reports home in order to continue work on them, and this was authorised by the relevant manager, in accordance with the Council's procedures.
At the time of the incident, the employee's manager had received the relevant training, but the social worker had not. The authority had a policy in place but this didn?t relate to the handling of paper documents while working from home.
Stephen Eckersley, the ICO's Head of Enforcement said:
Local authorities must recognise that social workers are handling some of the most sensitive information available. The fact that this information often relates to vulnerable young children means it is all the more important for these organisations to provide staff with adequate training and guidance on how to keep this information secure.
While Leicestershire County Council already recognised the risks associated with home working and had produced guidance for their staff, the guidance did not explain how papers containing personal information should be kept secure.
We are pleased that the Council have now committed to taking action to protect the personal information they handle and will extend its training programme to cover all staff who are regularly required to take this information outside of the office.
Leicestershire County Council have committed to amending their existing policies to include detailed guidance relating to the security of paper documents while working from home, training staff on these amended policies, putting appropriate monitoring in place to ensure compliance, and implementing other security measures to ensure personal data is protected.
The council told us the briefcase was recovered, with some of the information recovered too - they've given Capital the following statement:
The county council takes data security extremely seriously. As soon as it became aware that a briefcase had been stolen from a social worker's house, the council informed the Information Commissioner. We already have comprehensive information security arrangements in place, and constantly explore how we can improve these. This case has led us to reorganise our priorities.
We have made it clear that staff should not take confidential documents home unless it is absolutely necessary for their work and they have their manager's permission. If they do take documents home, they must lock them in a secure place. The council has signed an undertaking with the ICO, which commits it to updating policies, training staff and appropriate monitoring.
