ICO orders council to complete data protection training of all staff in 50 days

The Information Commissioner’s Office has issued an enforcement notice requiring a council to provide adequate data protection training for its staff within 50 days.

Accusing Wolverhampton City Council of a “startling” lack of urgency, the watchdog said it had given the local authority a series of warnings over the last two years.

In its enforcement notice, issued on 15 May, the ICO said it had been informed of an incident on 17 January 2012 in which confidential and highly sensitive data was disclosed in error by a social worker to a sibling who had no right to see that information. The social worker concerned had received no data protection training.

The watchdog subsequently made an audit recommendation on 20 December 2011 that Wolverhampton should implement a data protection policy and that staff should then receive mandatory training on that policy.

The council subsequently approved its new policy on 21 May 2013 and agreed to implement compulsory training for all staff with a completion date of the end of February this year.

The ICO said that only 32% of the authority’s employees had received the necessary training by 18 February.

In the enforcement notice the watchdog said it was satisfied that Wolverhampton had contravened the Seventh Data Protection Principle, in that it had failed to take appropriate measures to ensure the security of its data.

The ICO therefore ordered the authority to ensure that all staff have completed the Protecting Information e-learning module within 50 days. Subject to the council’s rights of appeal, it said the matter would be treated as a contempt of court if this requirement was not met.

ICO Head of Enforcement, Stephen Eckersley, said: “The lack of urgency displayed by Wolverhampton City Council is startling. Over two years ago, we reviewed the council’s practices and highlighted the need for guidance and mandatory training to help its staff keep residents’ information secure.

"Despite numerous warnings the council has failed to act, with over two thirds of its staff still remaining untrained. We have taken positive steps and acted before this situation is allowed to continue any longer and more people’s personal information is lost."

The enforcement notice can be viewed here.