SBC appeals against level of data breach fine

SCOTTISH Borders Council has launched an appeal over the size of a penalty from the Information Commissioner’s Office (ICO) after a self-reported data breach.

The ICO issued a £250,000 fine to SBC last month after files containing the pension details of former council employees were found by members of the public last year.

The first discovery was made by someone who found 676 files in a recycling bank in a supermarket car park in September. A further 172 files deposited on the same day but at a different paper recycling bin are thought to have been destroyed in the recycling process.

SBC employed a third party organisation to digitise the records but the ICO said the local authority didn’t follow correct procedures.

At the time SBC Chief Executive Tracey Logan said it was “very disappointing to receive such a high monetary penalty from the ICO especially in the current economic climate,” but the fine was paid in order to achieve a 20% discount on the total amount. This was done so with the caveat that SBC still reserved the right to appeal and one has now been submitted to the Information Tribunal.

The ICO has until November 2 to file a reply to the appeal. The case will then go to a three-judge panel for a decision, which is expected by the end of January.