ICO wags finger at York council after data breach
Have you ever left personal info lying around near the printer?
Posted in Management, 5th April 2011 11:06 GMT
Watch Now : Virtual Machine Movement with Hyper-V
The Information Commissioner's Office has slapped York council for breaching the Data Protection Act, after sensitive information was wrongly collected from a shared printer and then redistributed.
The papers contained personal data that was sent to the wrong person, the ICO said today.
A York council worker failed to spot that the papers, which had been carelessly left on the printer, were unrelated to their case.
The ICO found that York council had "robust policies and procedures in place covering the handling of personal data" but said the printer gaffe "highlighted a lack of quality control".
It also said the council needed to improve its personal ownership and management supervision skills among its staff when it came to the handling of sensitive data.
"This case highlights the need for employees to take responsibility and ownership of tasks that involve handling personal data. If the documents had not been left unattended by the printer and had been carefully checked before they were sent out then this situation could easily have been avoided," said ICO acting head of enforcement Sally-Anne Poole.
The council's boss Kersten England inked an undertaking with the ICO to put new procedures in place to prevent documentation containing any form of personal data from being printed where "there is no business need to do so".
In addition, York council will introduce new quality control checks on all the information its employees handle prior to dishing out documentation to others.
York council is expected to have its new procedures in place by August this year, said the ICO. ®
Watch Now : Virtual Machine Movement with Hyper-V
COMMENTS
it's that word again!
--------------------------------------------------------------
The ICO found that York council had "robust policies and procedures in place covering the handling of personal data" but said the printer gaffe "highlighted a lack of quality control".
--------------------------------------------------------------
Erm.... then their policies don't *really* qualify for the description "robust" then, do they?
A Quicker way
"York council is expected to have its new procedures in place by August this year, .."
This can be dealt with in less than an hour. Gather all the staff together, tell them, "If you take away or send out the wrong documents, then you're fired; so bloody well check them before you do anything with them."
Wrap the knuckles of the little ones while the big bullies go unchallenged
Well whoopey a lowly paid pen licker gets knuckles wrapped by Sir Christopher Graham. Bloggers following the ICO feel there is a clear trade off between quality and quantity with the rulings the Information Commissioner's office has come out with, and while the number of Decision Notices issued has clearly increased the quality of the Information Commissioner's office decisions has been on the decline with volume replacing substance.
For example if you think the Information Commissioner will come to your aid in having DNA records and records of arrest removed that the police should not keep after a court rules you have no case to answer, do not hold your breath. He will come out all in sympathy and then quote all the obsure laws and exemptions to you mentioned before. Another case solved by Chris and his toothless tiger team.
Christopher Graham became Information Commissioner in June 2009. He reports directly to parliament. He should be the first to point out to the government, hey with a million innocents on a crime data base, we have some important data protection principles being trampled upon by the police forces in England. Instead he tries to see it this way, then that way, anything but a principled defense of our civil liberties.
It's much safer to slap a few fines on underfunded councils.
Or, you get decent shared printers with secure printing
You don't get you queued job until you stick your PIN in.
Works pretty well
No, no, that's not it
They HAVE robust procedures, they just don't USE them.
The new Office Garage series:
Enabling efficient data center monitoring
Top 10 SIEM implementer’s checklist
