Worker’s home PC uploaded child care data to the web, council claims

 Worker’s home PC uploaded child care data to the web, council claims

AberdeenCityCouncilhasbeenfined£100,000followingabizarreincidentthatledtoanumberofchildren'spersonaldatabeinguploadedtotheInternet. 

InFebruary2012,amemberofstaffsearchedtheInternetforhisownnameandjobtitle.Inthesearchresults,hefoundtheminutesofacouncilmeetingaboutachild. 

Thewebsitehostingthatfilealsocontainedthreeothercouncildocumnts,allofwhichcontained"highlysensitive"dataaboutanumberofchildren. 

Theemployeealertedthecouncil.Fourhourslater,"thedatacontrollerhadremovedthesourcedocumentsfromthewebsite",accordingtoapenaltynoticefromtheInformationCommissioner'sOffice.

Followinganinternalinvestigation,thecouncilconcludedthataparticularemployeehadtakenthefilestoworkonfromhome.Theemployee'sPCapparentlycontainedafiletransferprogrammethatautomaticallyuploadedthecontentsoftheir'MyDocuments'fileontotheInternet. 

TheemployeetoldthecouncilthattheirPCwassecondhandandthefiletransferprogrammemusthavebeeninstalledwhentheyboughtit. 

HowthecouncilwasabletoremovethedocumentsfromtheInteretwithinfourhoursofbecomingawareoftheincident,despitenotknowinghowtheygotthere,isunclear.TheICOisunabletogiveanymoreinformationthaniscontainedinthepenaltynotice. 

TheICOfinedthecouncilbecauseofthesensitivityofthedataandbecausetheincidentrevealedlaxcontrolsoverthewayemployeeshandledocuments."Thedatacontrollerdidnotsupplythenecessarytechnicalmeasuresrequiredtosafeguardpersonaldatafromemployee'shome,"itsaid. 

Itaddedthatthecouncil'sdataprotectiontrainingwasinadequate. 

Comments (0)