The Information Commissioner’s Office (ICO) has become involved in an investigation into an alleged breach of the Data Protection Act (DPA) by the Scottish Court Service.
Private data contained within court documents was improperly disposed of at a recycling centre in Glasgow, according to reports, which has led to the ICO confronting the organisation with a formal undertaking.
The initial data loss was discovered in September last year when a local newspaper was alerted to the fact that highly sensitive details had been dumped in a public recycling bank and the ICO was subsequently involved in looking into how this could have occurred.
Scrutinising those responsible for the data allowed the ICO to determine that it had in fact been lost by an individual who had edited law reports for the service. The breach had been made possible because no member of the organisation had ensured that this person was properly informed on how to safely use this type of data.
The ICO’s Ken Macdonald,said that there was a possibility such a loss would damage the trust which people involved in the Scottish legal system would feel for the framework of justice that should, theoretically, protect their most basic rights.
Mr Macdonald said that the data should not have been taken outside of the courtroom and warned that if it had been picked up by a malicious third party, it could easily have resulted in the exploitation of those implicated in its contents.
From now on workers at the Scottish Court Service will undergo training in order to ensure that they all understand the data protection policies enacted by the organisation. This includes not only the way in which data is handled and used, but also how incidents of loss or theft are reported.
As part of the ICO’s measures the formal undertaking will require that every employee who shares data as part of their work is signed up to this so-called Memorandum of Understanding sanctioned by the powers that be.
