West Dunbartonshire Council warned of court action over data protection case
A council could face court action unless it fully implements staff training on data protection.
A council could face court action unless it fully implements staff training on data protection.
The Information Commissioner's Office (ICO) has now issued an enforcement notice to West Dunbartonshire Council over repeated failings that eventually led to a child's medical reports being stolen.
After an audit of the council in January 2013, management were told to implement training on data protection and guidance on home working for staff.
ICO said a follow-up in November 2013 found progress but showed some of the recommendations had not been implemented.
In July 2014, the council reported a data breach to the ICO after an employee had a bag containing confidential information stolen.
The worker had taken details of an adoption case out of the office to work on from home but a laptop and paperwork left in their car overnight were stolen, the ICO said.
An investigation found the employee had not been given training on the Data Protection Act and the council still had no guidance to staff on handling personal information when working from home.
The council only avoided a fine as the breach did not cause substantial damage or distress, the ICO said.
The enforcement notice means the council must now implement training and guidance or face court action.
Ken Macdonald, assistant information commissioner for Scotland, said: "Time and time again we have told this council to make these changes and yet they have still not completed everything we set out. We've been left with no choice but to issue this formal notice requiring them to act.
"Let's be clear, what we're asking for here is a basic requirement for an organisation that is trusted with large amounts of local people's personal data.
"When people in Dunbartonshire provide the council with their details, they expect staff are trained to handle this information properly.
"Unfortunately, more than three years after this was made clear to the council, this still hasn't happened.''
A council spokesman said: "West Dunbartonshire Council would like to apologise for this error. We take data protection seriously and referred ourselves to the Information Commissioner as soon as this breach took place.
"We are disappointed at the language used by Mr Macdonald, particularly as this comes during the period open to appeal - something the council is currently considering.''