By Steven McGinty

In August, Hampshire County Council were fined £100,000 by the Information Commissioner’s Office (ICO) after social care files and 45 bags of confidential waste were found in a building, previously occupied by the council’s adults’ and children’s services team.

Steve Eckersley, the ICO’s head of enforcement, explained that this data protection breach affected over 100 people, with much of the information “highly sensitive” and about adults and children in vulnerable circumstances.  In his view:

“The council’s failure to look after this information was irresponsible. It not only broke the law, but put vulnerable people at risk.”

A widespread problem

In 2015, Big Brother Watch, an organisation which encourages more control over personal data, published a report highlighting that local authorities commit four data breaches every day. It found that between April 2011 and April 2014 there were at least 4,236 data breaches. This included, at least:

• 401 instances of data loss or theft
• 159 examples of data being shared with a third party
• 99 cases of unauthorised people accessing or disclosing data
• 658 instances of children’s personal data being breached

In the past year, local authorities have reported a 14% increase from the previous year in security breaches to the ICO. The figures show that 64% of all reported breaches involved accidentally disclosing data. This supports research which suggests that human error is a major cause of data protection breaches.

These statistics are both positive and negative for the ICO. Peter Woollacott, CEO of Huntsman Security, suggests that it could show that local government is becoming better at identifying security breaches. However, he also acknowledges that most organisations are subject to multiple attacks, with only some being detected.

Areas for improvement

In 2014, the ICO conducted nine advisory visits and four audits of social housing organisations. It found that improvements could be made in ten areas, including:

• Data sharing – organisations regularly share personal data but few have formal policies and procedures to govern this sharing.
• Data retention – few organisations have data retention schedules for personal data, which provide details on when records should be disposed of, although most only extend to physical records. Data protection legislation sets out that data must not be stored for ‘longer than necessary’.
• Monitoring – there is little evidence that organisations monitor their compliance with data protection policies.
• Homeworking – where organisations allow staff to work flexibly, it often wasn’t formalised.
• Training – there are varying levels of data protection training found in organisations.

Public confidence

Unsurprisingly, high-profile data breaches, such as the loss of 25,000,000 child benefit claimants’ details in the post by HM Revenue and Customs (HMRC), have left the public concerned about their data.

In October, a YouGov poll showed that 57% of people believed that government departments could not share personal data securely. And 78% of people didn’t believe or didn’t know whether the government had the resources and technology to stop cyber-attacks.

A poll by Ipsos Mori has also shown that 60% of the public are more concerned about online privacy than a year ago. The three main reasons given were: private companies sharing data; private companies tracking data; and the reporting of government surveillance programmes.

The cost of data protection failures   

The implications of failing to protect the public’s data are serious. Not only could local government be heavily fined by the ICO, but it could also have an emotional or economic impact on individuals if their data enters the wrong hands and is used maliciously (e.g. to commit an act of fraud).  However, there are wider issues for government.

At the moment, both local and central government are undergoing digital transformation programmes, digitising their own operations and moving public services online. Examples include social workers using electronic social care records and the public paying council tax or booking appointments through their local council’s website.

If the public buy into ‘digital by default’ (the policy of ensuring online is the most convenient way of interacting with government), then services could be delivered a lot more efficiently, resulting in significant savings. However, if the public are concerned over the security of their personal data, they may be less willing to consent to its use by government.

We’ve already seen this in some areas. In 2014, the Scottish Government announced plans to expand an NHS register to cover all residents and share access with more than 100 public bodies, including HMRC. This year, the Scottish Government attempted to bring into effect the ‘Named Person Scheme’, where every child in Scotland would be assigned a state guardian, such as a teacher or health visitor.

With both of these schemes concerns have been raised over privacy, including from the ICO in Scotland. The Supreme Court has also ruled against the Named Person Scheme, over the data sharing proposals.

Final thoughts

Local government needs to be robust in ensuring compliance with data protection legislation. The financial costs could be great for local government, but the bigger concern should be public trust. If councils fail to meet their legal obligations, they may find it challenging to implement policies that use public data, even if it brings the public benefits.

---

Follow us on Twitter to see what developments in public and social policy are interesting our research team. If you found this article interesting, you may also like to read our other data related articles.