The London borough of Ealing has signed up to a series of measures to improve its data protection practices after a breach involving the loss of a set of court documents.

The incident involved documents being left in a folder on a car roof – Photo credit: PA Images

The Information Commissioner’s Office investigated the council after personal information, some of which was said to be sensitive, related to 27 people – including 14 children – was lost.

The incident happened in February this year when a social worker accidentally left a bundle of court documents on top of her car. They were never recovered.

Related content

Earning public trust in the age of cyber threats
Redbridge Council told to improve data protection training and governance

Although the council submitted mitigating factors about the incident – that the social worker had completed training and there were suitable procedures in place – the investigation exposed other failings.

This included that the council had no record of how many of the temporary staff – 27% of those in children’s services – had completed refresher data protection training, and that only 68% of permanent social care staff had done so.

“It’s vital that if councils are using temporary staff they make sure they, as well as permanent staff, are up to speed with how to look after people’s personal information,” said ICO enforcement manager Sally-Anne Poole.

She added that the council had “failed to follow our previous advice that it needed to improve training to make sure staff know how to look after personal information”.

The council has agreed to improve data protection training for staff – its target for completion of mandatory refresher training is 100% of staff – and review its policies on how documents can be protected outside the office.

Poole said: “Many of us have no choice but to take work out of the office. But when that work includes personal data, there is an obligation to ensure it’s kept safe. People have a right to expect that will happen.”