Quarter of councils don’t have data protection officer

A survey by the Information Commissioner’s Officer (ICO) has revealed that a quarter of councils are yet to appoint a data protection officer.

Receiving 173 responses, the Local Government Information Governance Survey also highlighted that over 15 per cent of councils do not have data protection training for staff processing personal data, and that 37 per cent do not have a data sharing policy in place, with only 17 per cent completing an Information Asset Register (IAR) to show what information they hold.

Under the new General Data Protection Regulation (GDPR), which comes into force in May 2018, councils will be legally required to conduct data protection impact assessments in certain circumstances and appoint a data protection officer. The ICO warns that, despite some examples of good practice, many councils still have substantial amounts of work to do to be prepared for the change.

Writing on the ICO blog, Anulka Clarke, ICO head of good practice, said: “It’s vital all staff keep data protection in mind – staff not knowing what they need to about data protection is behind many of the information security incidents our enforcement team sees in the local government sector.

“In the wake of an information security incident, swift reporting, containment and recovery of the situation is vital. Every effort should be taken to minimise the potential impact on affected individuals. As such, it’s a good idea to have a proper incident management process. Yet our survey showed 14 per cent of councils do not have an Information Security Incident Management Policy and 22 per cent do not consider reports and KPIs for information security breaches.”