Norfolk County Council files found in second-hand cabinet
- Published
The security breach by Norfolk County Council emerged when case files were found in a cabinet bought by a member of the public
A council has been fined £60,000 for leaving confidential files about vulnerable children in a cabinet which was sent to a second-hand shop.
The security breach by Norfolk County Council came to light in April 2014 when the cabinet was bought and the social work case files were found.
The Information Commissioner's Office (ICO) said the documents included information relating to seven children, external.
The ICO said the council had "no good reason" for breaching confidentiality.
The council apologised for the data breach and said it had tightened procedures.
'Security overlooked'
Steve Eckersley, ICO head of enforcement, said: "The council had disposed of some furniture as part of an office move but had failed to ensure that the cabinets were empty before disposal.
"Councils have a duty to look after any personal information they hold, all the more so when highly sensitive information is concerned - in particular about adults and children in vulnerable circumstances.
"For no good reason Norfolk County Council appears to have overlooked the need to ensure it had robust measures in place to protect this information.
"It should have had a written procedure in place which made it clear that any storage items removed from the office which may have contained personal were thoroughly checked before disposal."
The council has apologised for the data breach and said it had tightened procedures
The ICO added that having the "appropriate staff and procedures in place is key to ensuring councils look after personal information properly".
Simon George, executive director for finance and commercial services at the council, said: "We want to reassure residents that we have robust data protection procedures and have tightened practice in the light of the case published today.
"As a council we take data protection very seriously and we are very sorry that our practice fell short on this occasion.
"In the three years since this occurred, we have taken strong and effective action to ensure it is not repeated."
The county council was fined £80,000 in February 2012 by the ICO after a confidential social worker report was sent to the wrong address.