Council fined £250,000 for data breach

A council has been fined £250,000 following the dumping of former employees’ pension records in an over-filled paper recycling bin in a public car park. The council had outsourced the digitisation of the records to a third-party processor without agreeing a contract, obtaining guarantees on how the personal data would be kept secure or properly monitoring how the data was being handled.

The Information Commissioner imposed the £250,000 civil monetary penalty notice (MPN) using his powers under the Data Protection Act 1998. Our checklist explains what an MPN is and sets out when the Commissioner can issue an MPN against a business.