Thomas Bridge 07 June 2013

ICO fines Glasgow £150k for data breach

Glasgow City Council has been fined £150,000 following the loss of two unencrypted laptops, one of which contained personal information about 20,143 residents.

The monetary penalty, issued by the Information Commissioner’s Office (ICO), came after the laptops – containing the town hall’s creditor payment history file and 6,069 individuals’ bank account details - were stolen from council offices in May last year.

Complaints of theft and a lack of security had already been made about the council premises where the theft took place.

One laptop had been locked in a storage drawer and the key placed in an unlocked drawer with the second laptop.

This breach of the Data Protection Act comes two years after Glasgow was issued with an enforcement notice for losing an unencrypted memory stick containing personal data.

Despite previous warnings, the latest ICO investigation found Glasgow had issued a number of staff with unencrypted laptops – some of which were later encrypted - after encountering software problems. In total, the ICO found 74 unencrypted laptops remain unaccounted for at the town hall, six of which have been stolen.

Glasgow is now required to carry out a full audit of its IT assets used to process personal data and arrange for all its managers to receive asset management training. The local authority will also carry out an annual check of devices.

The ICO’s assistant commissioner for Scotland, Ken Macdonald, said: ‘Glasgow City Council was issued with an enforcement notice back in 2010 after a similar incident where an unencrypted memory stick was lost. To find out that these poor practices have returned some two years later shows a flagrant disregard for the law and the people of Glasgow.

‘The council should be held to account, and the penalty goes some way to achieving that.’

A Glasgow City Council spokesman said: ‘This data loss should not have happened and we took immediate steps to ensure it does not happen again. It is important to note that the number of unencrypted laptops was already coming down when this theft occurred.

‘The council co-operated fully with the ICO and wrote to everyone potentially affected to advise them of the data loss. The ICO acknowledges there is no evidence that any bank accounts have been targeted, that the council immediately informed it of the theft and that we carried out significant remedial action.’

What’s happening inside the LGPS? image

What’s happening inside the LGPS?

Get the most informed take on the challenges and opportunities that substantial reform will bring at this year’s PLSA Local Authority Conference.
SIGN UP
For your free daily news bulletin
Highways jobs

Senior Project Manager (Regeneration)

West Yorkshire Combined Authority
£49,359 to £56,057 per annum (pay award pending) – Grade 9
With ambitious goals ahead, we need dedicated individuals who are ready to make a real impact as part of our expanding Housing team Leeds / Hybrid
Recuriter: West Yorkshire Combined Authority

Information Governance Officer

Essex County Council
£28349.00 - £33351.00 per annum + pension
Information Governance OfficerPermanent, Full Time£28,349 to £33,351 per annumLocation
Recuriter: Essex County Council

Information Governance Officer

Essex County Council
£28349.00 - £33351.00 per annum + pension
Information Governance OfficerFixed Term, Full Time£28,349 to £33,351 per annumLocation
Recuriter: Essex County Council

HR Advisor - Pay & Policy (Career Grade)

Wakefield Council
Grade 9 - Grade 10, Career Grade, 24 hours, Permanent
Are you ready to make a difference and shape policies that foster a high performing and inclusive workplace? Wakefield, West Yorkshire
Recuriter: Wakefield Council

Leisure Support Assistant

Wakefield Council
£12,013.50 - £12,202.00, Grade 3, 18.5 hours, Permanent
Are You Ready to Make a Difference in Your Community? Wakefield, West Yorkshire
Recuriter: Wakefield Council
Linkedin Banner