ICO fines council £60k after details of child neglect case given to wrong person

The Information Commissioner’s Office has fined a local authority £60,000 after details of a child neglect case were sent to the wrong recipient.

The recipient (the mother of family B) read the report and contacted Plymouth City Council to warn it of the mistake.

However, she also sent a private message – via a social networking site – to the family covered by the report (family A), and sent a copy to her own solicitor.

The report contained confidential and highly sensitive personal data relating to two parents and their four children including allegations of child neglect resulting in ongoing care proceedings, the ICO said.

The incident occurred because a copy of the report printed off by a social worker was mistakenly picked up by a colleague, who assumed that the printing he had collected only contained his own report.

The second social worker then gave his report – now containing three pages of a photocopied report relating to family A – to the mother of family B.

Plymouth recovered the report from the mother of family B within two hours and told her that it was confidential.

The council was unaware that a copy had been sent to the solicitor, but this was subsequently destroyed.

An independent audit concluded that there was inherent weakness in Plymouth’s systems for printing and dispatching sensitive data to clients. It warned that unless action was taken to rectify the problem, a similar incident could happen again.

The ICO investigation found that Plymouth had no secure system in place for printing reports containing sensitive personal data, and had failed to take reasonable steps to ensure reports were checked before they were sent out.

The council has taken remedial action, including the introduction of a new printing procedure for the Children’s Services department that involves staff entering a user ID. Any items not printed within 12 hours are also automatically deleted from the print queue.

Stephen Eckersley, Head of Enforcement at the ICO, said: “It would be too easy to consider this a simple human error. The reality is that this incident happened because not enough care was being taken within the organisation when handling vulnerable people’s sensitive information.

“The distress this incident will have caused the people involved is obvious, and the penalty we have issued reflects that."

A spokeswoman for Plymouth City Council said: "In line with guidance, the incident was reported to the Information Commissioner's Office. The three pages were quickly recovered and destroyed, both clients were spoken with about the incident and our sincerest apologies were offered.

"Practical steps to prevent a similar situation happening again were taken including secure pin printing so that reports are only printed when staff activate the printer with their code, which reduces the risk of papers being mixed up.”

The spokeswoman added: "Extra checks before sensitive documents are dispatched from the office are also being devised. Children's Social Care have reinforced to all managers and staff that all employees have personal responsibility for the confidentiality of client information and the security of documents."