Surrey accepts record ICO penalty but suggests money could be "better spent"
Surrey County Council has said it accepts the Information Commissioner’s decision to fine the authority £120,000 for a series of data protection breaches, but argued that the money could have been “better spent” in its area.
Last week the ICO levied the highest monetary penalty so far on a local authority since the watchdog received new powers in April 2010.
An investigation by the ICO had found that Surrey had misdirected emails containing sensitive personal information on three separate occasions. Two of the incidents took place in the council’s adult and children’s services departments.
In a statement a Surrey CC spokesman said: “These incidents should never have occurred and we have apologised to the people involved.
“Immediate action has been taken to prevent this happening again. Measures have already been taken to reduce the risk of sensitive personal data being wrongly addressed and extra training on handling data securely has been given.”
He added: “We accept the commissioner’s findings but feel the money we were fined by another public sector organisation would have been better spent making further improvements in Surrey."
In an interview with Local Government Lawyer in March, Deputy Information Commissioner Graham Smith defended the size of monetary penalties being levied on the public sector at a time of cuts.
“It is important to recognise that the main purpose of a monetary penalty is to be a deterrent,” he said. “It is not a punishment – it is to deter all data controllers from making the same mistakes. So whilst I know that there have been many eyebrows raised in local authorities by the size of the monetary penalties, I know equally that an awful lot of local authorities and local authority officers will be saying, ‘well that could very easily have been us and what are we doing to make sure that it’s not us’.”
Smith also rejected claims that the public sector was a soft target compared to the private sector.
Philip Hoult
