Feeds

Sensitive council data sent to hundreds via PERSONAL EMAIL

ICO fines Cheshire East £80k for data breach

Beginner's guide to SSL certificates

Cheshire East council has been fined £80,000 by the Information Commissioner's Office (ICO) for failing to have adequate security measures in place when emailing personal information.

The ICO said the serious breach of the Data Protection Act occurred in May 2011, when a council employee was asked to contact the local voluntary sector co-ordinator to alert local voluntary workers to a police force's concerns about an individual who was working the area.

Instead of sending the email via the council's secure system, the employee sent it via her personal email account. The email contained the name and an alleged alias for the individual, as well as information about concerns the police had about him. The correspondence was then forwarded by the co-ordinator to 100 intended recipients.

The council employee said she sent the email from her personal account because the co-ordinator did not have an appropriate email address and that using the secure email system would have prevented the information from being further disseminated.

As the email did not have any clear markings or advice on how it was to be treated, the recipients interpreted the wording of the message to mean that they should also forward the email to other voluntary workers. As a result, it was forwarded on to 180 unintended recipients.

Following the breach, the council attempted to recall the email to prevent further disclosure. More than 57 per cent of the recipients said that they had deleted the information.

Stephen Eckersley, head of enforcement at the ICO, said: "While we appreciate that it is vitally important for genuine concerns about individuals working in the voluntary sector to be circulated to relevant parties, a robust system must be put in place to ensure that information is appropriately managed and carefully disclosed.

"Cheshire East council also failed to provide this particular employee with adequate data protection training. The highly sensitive nature of the information and the need to restrict its circulation should have been made clear to all recipients."

He added: "I hope this case, along with the fact that we've handed out over £1m worth of penalties since our powers came into force, acts as a strong incentive for other councils to ensure that they have sufficient measures in place around protecting personal data."

This article was originally published at Guardian Government Computing.

Guardian Government Computing is a business division of Guardian Professional, and covers the latest news and analysis of public sector technology. For updates on public sector IT, join the Government Computing Network here.

Protecting users from Firesheep and other Sidejacking attacks with SSL

More from The Register

next story
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
Jihadi terrorists DIDN'T encrypt their comms 'cos of Snowden leaks
Intel bods' analysis concludes 'no significant change' after whistle was blown
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
China hacked US Army transport orgs TWENTY TIMES in ONE YEAR
FBI et al knew of nine hacks - but didn't tell TRANSCOM
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
NORKS ban Wi-Fi and satellite internet at embassies
Crackdown on tardy diplomatic sysadmins providing accidental unfiltered internet access
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
Protecting users from Firesheep and other Sidejacking attacks with SSL
Discussing the vulnerabilities inherent in Wi-Fi networks, and how using TLS/SSL for your entire site will assure security.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.