|Personal data of housing benefit claimants was disclosed to the wrong housing association.
|An undisclosed number of records.
|August 2009 to November 2012
|Correspondence containing personal data was sent in error by the council’s Revenues and Benefits service to a Mansfield housing association over an extended period.
|What is interesting about this breach is that it was reported to the ICO by the housing authority that received the data in error, and not Mansfield Council. I suspect that the housing association will first have contacted the Council and after that had no effect on the incorrectly addressed correspondence (the breach continued for three years), alerted the Commissioner. The Council’s real failing was to not fix the problem when told about it.
|Undertaking to comply with the seventh data protection principle
|25 January 2013
|Employees and any other staff with access to personal data must be made aware of, and trained in, the policy for storage and use of personal data. Training must be provided to contractors as well as staff, and records of training to be maintained.
|The breach was almost certainly due to administrative human error; however our view is that the enforcement action was taken as a result of the council not fixing the problem when it was initially alerted. The core problem was that the council didn’t have a sufficiently robust plan to identify and rectify a data breach when it was first reported. The undertaking should have also included a requirement for the Council to develop and test a breach response plan, which identified data breaches and ensured they were rectified.
|View PDF of the Mansfield District Council Undertaking (Breach Watch Archive)
|View PDF of the Mansfield District Council Undertaking (Via ICO Website)
|The ICO conducted a follow up assessment on 03 May 2013 (published by ICO on 01 November 2013).
|View PDF of the Mansfield District Council Undertaking Follow Up (Breach Watch Archive)
|View PDF of the Mansfield District Council Undertaking Follow Up (Via ICO Website)