OH NO IT’S THE ICO (Revisited)

 

Just to update you on a story that we published in autumn concerning a breach of data protection by Wirral Council.

Environmental Disaster

The story clearly upset someone who goes by the pseudonym of R.Sole . Well we presume it’s a pseudonym  , either that or they were an unwanted child. The only thing we haven’t printed from their email to Leaky Towers is who they addressed their delightful missive to – because  a) they’re out of order and b)  way off  target.

It was interesting to see your recent story regarding noise logs being “dumped” in the street by Council officials.

You really do embellish the truth don’t you!!  It is quite obvious that they weren’t dumped, dickhead.  This was obviously a genuine mistake by a Council officer who either dropped them by accident or had them stolen.

I admit that he or she was very careless but to say that they were deliberately dumped is ludicrous.

Get your facts straight before you publish.  You fucking idiot.

Regards

R. Sole

Dear R. Sole

We didn’t say the documents were “deliberately dumped”.

You say dropped , we say dumped. However they ended up on the pavement it’s still a breach of the Data Protection Act

What we’re left wondering is why you choose to provide such positive feedback on a Saturday night  7 weeks after we published the story ? 

You also ask us to get our facts straight (by the way it wasn’t just information about noise logs). Do you know more about the incident than our source ?- if so would you care to share that information so we can set the record straight?

Thankfully we are able to go back to our original source who provides us with an update on the story  having received a more polite response from the Information Commissioner’s Office (ICO) than we did from R.Sole.

It is interesting to note that the ICO tell us that Wirral Borough Council ‘self reported’ the breach of the Data Protection Act. Was this before or after we’d reported the matter on Wirral Leaks ?  No prizes for guessing !

Nevertheless we’ll be checking out the ICO website to see what action – if any- they publicly (rather than publically) choose to take .  Needless to say censure by the ICO is very much a case of deja vu when it comes to Wirral Council :

 https://wirralleaks.wordpress.com/2012/12/31/oh-no-its-the-ico/

Dear Sir/Madam

Thank you for your email of 14 October 2016 concerning papers you found belonging to Wirral Borough Council relating to noise complaints.
 
We want to know how organisations are doing when they are handling information rights issues. We also want to improve the way they deal with the personal information they are responsible for. Reporting your concerns to us will help us do that.
 
Our role is not to investigate or adjudicate on individual concerns but we will consider whether there is an opportunity to improve the practice of the organisations we regulate. We do this by taking an overview of all concerns that are raised about an organisation with a view to improving their compliance with the Data Protection Act 1998.
 
I can confirm that Wirral Borough Council has self-reported this matter to us and we are investigating this incident. As part of our investigation we will take steps to ensure that the council has addressed all foreseeable weaknesses in its organisational and technical controls, with a view to reducing the potential for a recurrence.
 
Although I cannot confirm what action, if any, we will take, in common with all such cases I can advise that there are four options available to us:
 
 We may issue advice. This may take the form of a letter, or an undertaking. The latter is a publically available document signed by both the ICO and the organisation to which it is issued;

• We may mandate the steps required to reduce the likelihood of a recurrence by way of a formal Enforcement Notice;

• In the most serious cases, we may issue a Civil Monetary Penalty. This acts as a deterrent against future incidents;

• Finally, we may offer an audit or advisory visit. These allow the ICO to review specific areas of a data controller’s compliance and to make tailored recommendations for improvement.

 
Further details of all our regulatory powers can be found in our Regulatory Action Policy, which can be found on our website.
 
The above steps are not mutually exclusive and in common with all such cases we will use a combination of our powers to ensure that both the incident and any improvements required are appropriately addressed. 
 
At this stage we are unable to confirm what the outcome of that investigation will be. We will not write to you again in this matter but any formal regulatory action will be published on the ICO’s website.
 
I hope this information is helpful. Thank you for bringing this matter to our attention.