North East Lincolnshire Council has been fined £80,000 after losing a memory stick containing sensitive information about 286 children with special needs.
The Information Commissioner’s Office (ICO) served the local authority with the monetary penalty after an unencrypted memory stick was left in a laptop at the council’s offices by a special educational needs teacher and never recovered.
Chief executive of North East Lincolnshire Council, Tony Hunter, apologised for the error and added that immediate action had been taken to ensure such an incident did not occur again.
The device included information on the mental and physical health problems of local children, alongside a number of home addresses and information about some of the children’s personal lives.
An internal report undertaken by the council confirmed the individuals affected would suffer ill-health due to the loss.
While North East Lincolnshire had introduced a policy of encrypting portable devices in April 2011, the council failed to ensure existing sticks being used by staff were encrypted.
ICO head of enforcement, Stephen Eckersley, said: ‘Organisations must recognise that sensitive personal data stored on laptops, memory sticks and other portable devices must be encrypted.
‘North East Lincolnshire Council failed to do this by delaying the introduction of a policy on encryption for two years and then failing to make sure that staff were following the policy once it was finally implemented.
‘This breach should act as a warning to all organisations that their data protection policies must work in practice, otherwise they are meaningless and fail to ensure people’s information is being looked after correctly.’
Hunter said: ‘This data loss should not have happened and we took immediate steps to try to ensure it does not happen again. It is important to note that since the data loss, we have made major improvements to our policies, training and procedures to prevent another incident like this happening again.
‘The ICO acknowledges there is no evidence that any individual or family have been targeted as a result of the incident, that the council immediately informed it of the loss and that we have carried out significant remedial action.’
