City of York Council in personal data breach after printer mix-up

The City of York Council breached the Data Protection Act by accidentally disclosing personal data to a third party following a printer mix-up, the Information Commissioner’s office (ICO) said today.

The breach was first reported to the ICO by the council on 10 February after information containing personal data was incorrectly sent out with other documentation to an unrelated third party. The information, which includes sensitive personal data, was only included after being mistakenly collected from a shared printer, before being copied and posted by an employee who failed to check whether the papers were relevant to their case.

While the ICO found that the council had robust policies and procedures in place covering the handling of personal data, the case highlighted a lack of quality control, personal ownership and management supervision within the council and amongst their staff.

Sally-anne Poole, acting head of enforcement, said:
“This case highlights the need for employees to take responsibility and ownership of tasks that involve handling personal data. If the documents had not been left unattended by the printer and had been carefully checked before they were sent out then this situation could easily have been avoided.

“We are pleased that the City of York Council has introduced new security measures governing the use of its printers and that staff will now be required to carry out appropriate quality control checks to avoid information being incorrectly disclosed in this manner.”

Kersten England, chief executive of the council, has signed an undertaking to ensure that new procedures are put in place to prevent documentation containing any form of personal data from being printed where there is no business need to do so.

The council will also bring in new quality control checks on all the information they handle prior to distribution, as well as extending their clear desk policy to include printer trays, post trays and other pending work trays. The council has agreed that all of the measures outlined in the undertaking will be in place within the next four months.

A full copy of the undertaking can be viewed here:
http://www.ico.gov.uk/what_we_cover/promoting_data_privacy/taking_action...