Council fined after confidential care files found in disused building

Hampshire council has been fined £100,000 after confidential files containing “highly sensitive” details of vulnerable adults and children were found in a disused building.

The Information Commissioner issued the penalty after the files, along with 45 bags of confidential waste, were found at Town End House in Hampshire in August 2014. The documents contained personal details of more than 100 people.

The documents were discovered by a company who had purchased the building from the local authority. The office was vacated by Hampshire’s adults and children’s services in July 2012, meaning the agents selling the property and prospective buyers had access to it for two years before the documents were found.

The Information Commissioner Office (ICO) investigation found the council failed to follow laws on safeguarding against the accidental loss of personal data and had no clear procedure around the decommissioning of Town End House.

Steve Eckersley, ICO head of enforcement, said: “Hampshire County Council failed to ensure that highly sensitive personal data about adults and children in vulnerable circumstances was disposed of.

“The council knew the building had housed a department that dealt with confidential information and should have had a proper procedure in place to check no personal data was left in the building. Organisations must implement effective contingency plans to protect personal data when decommissioning buildings.

“The council’s failure to look after this information was irresponsible. It not only broke the law but put vulnerable people at risk.”

The local authority has up to 12 September to pay the fine or appeal the ICO decision.

A spokesperson for Hampshire council, said: “We are very sorry that this incident occurred. Hampshire County Council takes the management and protection of its data very seriously. Accordingly, appropriate procedures were in place at the time, but unfortunately, on this occasion, the process was not fully adhered to. However, at no time was any information disclosed outside of the site.

“Immediate steps were taken to investigate the matter fully, and remedial action was taken. This has included strengthened and improved processes in the removal of, and destruction of, confidential waste from vacated buildings.

“We reported the incident to the ICO as soon as we became aware of it, which was at the point the company referred the incident to the County Council – and have cooperated fully at all stages of the ICO’s investigation. We are currently considering the ICO’s decision.”