Council wins appeal over ‘unjust’ data breach fine

Scottish Borders Council headquarters at Newtown
Scottish Borders Council headquarters at Newtown

A DECISION to fine Scottish Borders Council £250,000 for a data breach has today been overturned.

The local authority was fined after employee pension records were found dumped in a supermarket car park.

After a four-day hearing which concluded in Edinburgh, the Information Tribunal overturned the decision by the Information Commissioner’s Office (ICO) to issue the Monetary Penalty Notice (MPN).

SBC was issued with the MPN in September 2012. The council paid the fine in order to achieve a 20 per cent discount on the total amount but lodged an appeal.

After considering SBC’s appeal, the tribunal said there were insufficient grounds to justify the MPN issued by the ICO and as such, the amount already paid to the ICO by SBC will be refunded.

The tribunal has requested both parties work together to identify the progress made on improving processes and systems since the breach. A joint report containing this information, along with any outstanding actions and a timetable to implement these, must be submitted to the tribunal panel by September 10.

SBC chief executive Tracey Logan said: “I am extremely pleased with the outcome and have always strongly believed that the monetary penalty notice issued by the ICO in this case was unjust and disproportionate.

“Of course, I acknowledge that there were gaps in our processes in this case – but we have taken significant steps to address these since the breach to ensure data protection continues to be a high priority across the council.

“We are committed to continue to work with the ICO to ensure our processes and policies are as robust as possible.”

Council leader David Parker commented: “I am delighted with today’s outcome. To issue such a high monetary penalty on a public authority in this economic climate was excessive, especially when the breach was self-reported and officers took all appropriate steps on the discovery of this incident and cooperated fully with the ICO at all times.

“Data and information security is a priority at SBC – and I am confident that the work taking place across the council to address any issues will be acknowledged appropriately in the future.

“I would like to thank the members of the Information Tribunal Appeal Panel who ensured that our appeal was heard and conducted in a fair and constructive way.

“The process of the appeal has taken four days of hearings and the Tribunal members had considerable written material to consider – but they have worked tirelessly to ensure a fair and sensible outcome.”