Norfolk County Council fined £60k for careless data management

Norfolk County Council has been issued with a £60,000 penalty after it was revealed confidential files regarding vulnerable children had been left in a cabinet which was sent to a second-hand shop.

The security breach came to light in April 2014 when the cabinet was bought and the social work case files were found, relating to seven children.

Steve Eckersley, the Information Commissioner's Office (ICO) head of enforcement, said: "The council had disposed of some furniture as part of an office move but had failed to ensure that the cabinets were empty before disposal.

"Councils have a duty to look after any personal information they hold, all the more so when highly sensitive information is concerned - in particular about adults and children in vulnerable circumstances. For no good reason Norfolk County Council appears to have overlooked the need to ensure it had robust measures in place to protect this information.

"It should have had a written procedure in place which made it clear that any storage items removed from the office which may have contained personal were thoroughly checked before disposal."

Simon George, executive director for finance and commercial services at the council, commented: "We want to reassure residents that we have robust data protection procedures and have tightened practice in the light of the case published today.

"As a council we take data protection very seriously and we are very sorry that our practice fell short on this occasion.

"In the three years since this occurred, we have taken strong and effective action to ensure it is not repeated."