back to article Norfolk County Council sent filing cabinet filled with kids' info to a second-hand shop

Norfolk County Council left files containing sensitive information about children in a cabinet that was dispatched to a second-hand shop. As a result of the gaffe, the council, tucked away on the east coast of England, was this month fined £60,000 [PDF] by the UK Information Commissioner's Office (ICO) The cockup occurred …

  1. Alister Silver badge

    The Register has contacted Norfolk County Council for comment

    You'll be lucky, the response from the Council is in the bottom of a locked filing cabinet in the basement of a secondhand shop in Great Yarmouth...

    1. malle-herbert Silver badge
      Joke

      All that's missing is a sign saying : "Beware of the leopard"...

      1. Anonymous Coward
        Anonymous Coward

        You have just made my morning - thank you!

      2. PNGuinn Silver badge
        Trollface

        All that's missing is a sign saying : "Beware of the leopard"...

        No, that's now in a second hand shop in Lowestoft where they sent it in error ....

        NFN.

        1. Korev Silver badge
          Thumb Up

          Re: All that's missing is a sign saying : "Beware of the leopard"...

          Upvote for the NFN

  2. Dr Scrum Master

    "It should have had a written procedure in place which made it clear that any storage items removed from the office which may have contained personal were thoroughly checked before disposal."

    Or it could have employed people who had a modicum of common sense.

    Meanwhile, it's the council tax payers who'll eventually foot the bill.

    1. Spudley

      "It should have had a written procedure in place which made it clear that any storage items removed from the office which may have contained personal were thoroughly checked before disposal."

      Or it could have employed people who had a modicum of common sense.

      Agreed.

      If that kind of thing needs to be written down for people to actually think to do it, then we're in trouble. We're also going to need a lot more filing cabinets to hold all the written procedures to make sure people do things that ought to be obvious.

      More seriously, I suspect that with the point about "it should have been written down", they're not really trying to suggest that people might have done it differently if there had been a written procedure; it's more about the fact that in the absence of a procedure that's been broken, means that they don't have any ability to discipline the individuals responsible.

      1. Anonymous Coward
        Anonymous Coward

        If you don't have a procedure then you can't check that things are being done. And you certainly can't make sure they are applied consistently across an organization.

        That is my take after a fair few years running an activity accredited to an ISO standard.

        Policy -> Procedure/SOP -> monitoring for compliance -> well-deserved bollocking when it goes wrong (technically corrective/preventative actions) ->improved procedures

      2. I am the liquor

        Written procedure

        Or looking at it from another perspective, the existence of a written procedure -- even if held in a locked filing cabinet in a disused lavatory, etc., etc. -- allows any mishap to be blamed on some hapless peon, instead of the management.

      3. The Nazz Silver badge

        Saves further unwarranted expense, i suppose

        re Spudley

        I disagree. Yeah, there was no written policy for a lowly employee to follow but there sure was a 35 hour a week maximum, loads of time off in lieu, and most Fridays at home, very well paid (and remunerated) "manager" or "executive" whose ROLE it is is to write such a Policy and see that it's adhered to.

        Disciplinary procedures against such a person?

        Hell NO. At that grade these usually consist of a large PAYMENT to actually leave the job, additional pension payments etc rather than be dismissed. Oh and by the way, here's a similar vacancy two councils down the road.

      4. Doctor Syntax Silver badge

        "If that kind of thing needs to be written down for people to actually think to do it, then we're in trouble."

        That's ISO9000 and friends for you. They're bureaucracy standards which are intended to replace thinking so the least skilled or intelligent people you can recruit will be able to follow them.

      5. Anonymous Coward
        Anonymous Coward

        "in the absence of a procedure that's been broken, means that they don't have any ability to discipline the individuals responsible."

        Last time I looked, gross misconduct and/or gross negligence are reasons for disciplinary action, up to and including immediate dismissal. They have the ability to discipline the individuals responsible: the real question is whether they have the will to identify them ...

    2. creepy gecko
      Facepalm

      This ----> "Meanwhile, it's the council tax payers who'll eventually foot the bill."

      The council may even put next years council tax up by a few pennies to take the fine into account.

      It's about time the actual persons guilty of such data breaches were also penalised by the ICO. It would probably make people a little more aware of their responsibilities if they knew they could get fined after a blatant cock-up.

      1. macjules Silver badge

        Well, they could admit they screwed up and pay up, in which case they only have to pay £48,000.00 ... but what's £12,000.00 when you're a local government bureaucrat with no responsibility or accountability.

      2. Tom Paine Silver badge

        Would you take a low-level clerical job paying £25k where a mistake would land you with a £60k bill? I certainly wouldn't. Come to think of it, I wouldn't do it for twice the pay I'm on now, which is a bit more than that.

      3. Alan Brown Silver badge

        "It's about time the actual persons guilty of such data breaches were also penalised by the ICO."

        That would need a law change. Unfortunately.

    3. John Brown (no body) Silver badge

      "Or it could have employed people who had a modicum of common sense."

      ...and followed by lots of comments about written procedures etc, but I wonder how many people here have a filing cabinet and would think to or remember to, pull all the drawers out properly and check down inside in case any documents have fell through? The fact it's documents relating to only 7 people suggests this as the most likely scenario and, in hindsight, something that should have been checked but I'd be prepared to bet that even with a written procedure, the majority of people would think that opening the drawers and checking they were empty was ll that was needed.

      Many filing cabinets don't make it easy to remove a drawer so you might have try to get your head in there somehow (health and safety issue??) or scrabble around blindly with your hand down behind the drawer.

    4. tfewster Silver badge
      Facepalm

      "It should have had a written procedure in place which made it clear that any storage items removed from the office which may have contained personal were thoroughly checked before disposal."

      They DO have written procedures to not release personal info. If the suggestion is that all the ways that personal info must NOT be released are listed, they're pretty much infinite:

      Not in your head, Not in a folder, Not on a USB stick, Not on a floppy disk, Not in a filing cabinet, Not on an HDD ...

      (To paraphrase Dr Seuss: I do not release personal info, I do not do it, Sam-I-am)

  3. Hans 1 Silver badge
    Happy

    >Meanwhile, it's the council tax payers who'll eventually foot the bill.

    Yes!

    And I am sure they will remember that one, comes election day!

    1. druck

      Election day won't change anything, the screw up is by the employees of the council, not the elected councillors.

      1. BebopWeBop Silver badge
        Facepalm

        Elections seem to make little difference - no matter what they do, most moron councils get elected by the same morons (I assume) - certainly the three wards I have lived in over the last 20 years seemed to pay little heed to incompetence or corruption

  4. TRT Silver badge

    Ha ha ha!

    Surely no-one would send something which could even possibly hold data down a recycling and disposal route without double and triple checking.

    </sarcasm>

    1. phuzz Silver badge

      Re: Ha ha ha!

      I'm more surprised that whoever actually moved the filing cabinet didn't go "This is bloody heavy, is there still something in it?" followed swiftly by "oh yes, there is, well I'll chuck that in the skip before I go any further then". Who moves furniture without emptying it?

      1. TRT Silver badge

        Re: Ha ha ha!

        Hah! Yeah. The skip. That's better.

      2. ahjgta

        Re: Ha ha ha!

        Remember the episode with Alf Garnett finding all the ancient cash in the hidden drawer in Mrs. ... wardrobe.

        Great slapstick. I am laughing as I remember him kicking the wardrobe and getting thumped on the head with the drawer.

      3. Nick Ryan Silver badge

        Re: Ha ha ha!

        Given that it's "just" 7 records I'd guess that the cabinets had been emptied but some files fell down the back and were at the bottom. Anything vaguely heavy would/should have been spotted by council staff, movers or charity staff.

        1. Robert Carnegie Silver badge

          It could happen to you.

          It happens to me - papers falling down the back of a desk drawer unit. You have to take all the drawers out to reach the stuff. That doesn't make it all right, you'd still have to look, but it's very understandable. Upvote.

          On the other hand, the stuff may have been a few files in a drawer normally. Less excusable but still easily done.

          I've just been reading 1970s sci-fi novel [Tomorrow Is Too Far] where a factory security manager gets a clue - not the first as it turns out - to Something Going On, when an empty storeroom, never used - is the site of a small fire, destroying a small quantity of mysterious documents. My point is that you can be equally confident that your old drawers don't contain leftover documents, but you do still have to check at an appropriate last opportunity, just as I check my trouser pockets as they go into the washing machine, for overlooked love letter !s from a secret admirer, or non-washable banknotes, or really anything. The first two are almost never found, but it's still better to check, than to be sorry later.

  5. Spudley

    I'm also really surprised that this was found by the buyer, and not by the charity shop.

    Charity shops routinely check for contents in any furniture they're given. Very often there's something hiding in there that is more valuable than the furniture itself.

    1. creepy gecko
      Joke

      @Spudley

      Perhaps the ICO should have fined the charity shop as well!!

    2. Anonymous Coward
      Anonymous Coward

      I'm also really surprised that this was found by the buyer,

      An interesting question is whether the cabinet was never emptied, or was it just that it was mostly (but not very-carefully) emptied by the council staff, who perhaps (e.g.) missed a few documents that had slipped down the back of the drawers? In the latter case, the sort of quick inspection a charity shop, or a customer therein might give it could easily miss them (and, apparently, did).

    3. Mystic Megabyte Silver badge
      Happy

      @Spudley

      I once scored a sofa and armchair from a vicarage. I dived down and retrieved about £10 and six Parker pens. Result!

  6. Patrician

    While I fully support fining for this type of security breach, it must be said that it is the people of Norfolk that will actually be paying the fine, not the idiots that were responsible for this.

    When government bodies do this type of thing fining doesn't really achieve anything as it's not the organisations money and they don't care; there needs to be some kind of punishment to make sure more care is taken in future, something along the lines that the person responsible looses their job for instance. Or am I just being silly?

    1. Jason Bloomberg Silver badge

      The problem with holding individuals responsible is they will want more money to reflect that degree of responsibility and it will only end in the fiasco of buck-passing anyway.

      If anyone ever is held as responsible as people might like, there will be no one willing to take on those job lest some underling fucks up and they have to carry the can. But it's probably going to be an underling who carries the can while the exec really responsible walks away without punishment courtesy of lawyering-up.

      While saying individuals should be held to account, punished for mistakes, it's very hard to achieve that in practice.

    2. John Brown (no body) Silver badge

      "something along the lines that the person responsible looses their job for instance."

      If it was traceable to an individual, then they will likely have embarked on a trip down the disciplinary procedures. If someone higher up was responsible for putting a procedure in place and they'd not done it, they the same may apply to them.

      I've not personally had dealings with ICO incidents, but a friend at a local council has been (as an observer, not a participant, natch!) and he said the report back to the ICO was supposed to include tracing and placing of "blame" where possible and measures/sanctions taken. This implies that the ICO want to see relevant individuals at whatever level taken to task.

  7. adam payne Silver badge

    "Steve Eckersley, ICO Head of Enforcement, said: “The council had disposed of some furniture as part of an office move but had failed to ensure that the cabinets were empty before disposal."

    The council staff failed to check, the people removing them failed to check and the charity failed to check. All have to take some responsibility for this but the council has to take the lion share.

    “For no good reason Norfolk County Council appears to have overlooked the need to ensure it had robust measures in place to protect this information. It should have had a written procedure in place which made it clear that any storage items removed from the office which may have contained personal were thoroughly checked before disposal.”

    Regardless whether there is or isn't a written procedure for this, common sense should have kicked in at least.

    1. Mephistro Silver badge

      I beg to disagree

      Neither the people moving the furniture nor the charity have a duty of guard regarding the data.

    2. PNGuinn Silver badge
      Flame

      Disposal of filing cabinets

      ""Steve Eckersley, ICO Head of Enforcement, said: “The council had disposed of some furniture as part of an office move but had failed to ensure that the cabinets were empty before disposal.""

      Everywhere I've ever worked filing cabinets were like hens teeth. I'll bet the first thing the department did after their move was ...

      Followed a few weeks months later by ... " has anyone seen the files on little Alice, Joan, Harry ....? (NB fictitious names.)

  8. MrT

    Norfolk County Council...

    ... are almost permanently featured somewhere in Private Eye. Child 'M', foster carer fiasco, Children's Services rated inadequate, winning the Eye's 'Whitewash Award for Local Government' in 2015, etc. They've a reputation of burying the truth and protecting NCC officials, so don't expect anyone to be named as responsible for this latest dropped bollock any time soon, if at all.

    1. Yet Another Anonymous coward Silver badge

      Re: Norfolk County Council...

      But last time they sent a cabinet containing actual children to the scrap yard - so this is an improvement

    2. Doctor Syntax Silver badge

      Re: Norfolk County Council...

      Years ago I was in a 2nd hand bookshop in Cromer & found yards and yards of bookshelves occupied by bound volumes of Nature from the County Library. After that I'd not be surprised of them disposing of almost anything.

    3. Mystic Megabyte Silver badge

      Re: Norfolk County Council...

      My ex worked (or works) at the local councils children's home as a social worker. It's the place where they put emergency kids, I forget the terminology. Some years back it transpired that her boss had completely bogus qualifications. He had also molested some young lad. He got the sack but no police were involved. He went on to molest other boys before having to leave the county for his own safety.

      AFAIK he eventually got time for something or other and I hope that I never see him again.

    4. John Brown (no body) Silver badge
      Joke

      Re: Norfolk County Council...

      "so don't expect anyone to be named as responsible for this latest dropped bollock any time soon, if at all."

      Well, it's not as if there were a lot of victims. You can count them on the fingers on one hand!

  9. Evil Auditor Silver badge

    Protect its information?

    Yes, but even more importantly: It should have had a written procedure in place which made it clear that any storage items removed from the office which may have contained personnel were thoroughly checked before disposal.

    Unimaginable had someone been fallen asleep in there...

    1. PNGuinn Silver badge
      Boffin

      Unimaginable had someone been fallen asleep in there...

      Nah - by then they'd be fully dehydrated and all smell dissipated. Light as a fevver, m'lud.

      Probably still drawing their salery / pension though. Although they might have been missed at their office retirement bash ...

  10. GruntyMcPugh Silver badge

    This is one of the many reasons why I hate printers. And users.

    I have worked in schools, several of the databases containing information about children make it clear the data comes under IL3 and should not be printed. If notes are taken, they should be transcribed and destroyed. This error by the council is pretty unforgivable.

    1. Mystic Megabyte Silver badge
      Thumb Up

      up, up

      I just wanted to upvote you for your most excellent username, carry on!

  11. Anonymous Coward
    Anonymous Coward

    Recoup the cost

    The person that found the documents is going to have full bins for a long time now and parking fines galore.

    Also planning applications will take a lot longer.

    Dude needs to move fast.

    1. JimC Silver badge

      Re: Recoup the cost

      So on the one hand the council is a bunch of incompetents who can't find posterior with both hands, and on the other hand they have the organisational capability to run a revenge campaign across at least three entirely separate departments, all without it getting leaked to the local paper?

      1. John G Imrie Silver badge

        Re: Recoup the cost

        He didn't say it wouldn't get leaked to the local paper, or featured in the next edition of Private Eye ether. :-)

      2. Yet Another Anonymous coward Silver badge

        Re: Recoup the cost

        They could bring in outside consultants to manage the campaign

  12. Stevie Silver badge

    Bah!

    Time for someone to get flonked with a dwile!

  13. Chris 125

    If you fine a council, where does the money come from?

    I can't think of an answer apart from "by depriving citizens of £60k worth of 'stuff'" or increasing parking fines etc.... It's not like fining a business where it comes out of their profit.

    Serious question, what protection is in place to make sure this comes out of bonuses and the jar of money they have to make sure they have nice cakes in the canteen and decent coffee in the machines.

    1. Anonymous Coward
      Anonymous Coward

      There is probably no protection. However, I suspect council bog roll will suddenly be shinier and harder than its ever been moving forward.

      1. Anonymous Coward
        Anonymous Coward

        >There is probably no protection. However, I suspect council bog roll will suddenly be shinier and harder than its ever been moving forward.

        Whatever happened to Izal?

        1. Mine's a pint
          Coat

          Whatever happened to Izal?

          Bronco!

        2. Mystic Megabyte Silver badge
          Happy

          Izal

          You may not believe this and it's possible that I should not relate this tale, but what the heck!

          Our family were working class and we lived in a council flat. My Dad used to steal Izal from where he worked. In our bog we had two toilet paper holders. Sitting on the throne to your right was the black enamelled Izal holder for real men to use. On your left was the softy liberal pink bog roll for women or soft bottomed men.

          I really hoping that the next comment has the word "luxury" in it :)

        3. Bob Rocket

          Izal - Government Property

          https://forums.digitalspy.com/discussion/1485107/does-anyone-remember-that-toilet-paper-that-was-like-tracing-paper

      2. Mephistro Silver badge
        Coat

        That would be "cruel and unusual punishment"! 8^)

  14. Mark 85 Silver badge

    Ah.... the buzzwords

    Gotta' love it... usage repeatedly of "robust" "taking data protection seriously", etc... Someone is obviously a PR or marketing type.

  15. FlamingDeath Bronze badge

    Fucking Muppetry

    Why are coucils such massive bellends?

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Biting the hand that feeds IT © 1998–2019