Tribunal overturns Scottish Borders Council’s £250,000 data breach fine

David Parker and Tracey Logan launch the SBC information campaign
David Parker and Tracey Logan launch the SBC information campaign

The £250,000 fine issued to Scottish Borders Council after employee records were found in a recycling bin has been overturned at a tribunal today.

The forfeit was made in September last year by the Information Commissioner’s Office and although SBC paid up £200,000 straight away in order to achieve a 20 per cent discount, it also lodged an appeal.

The money will now be refunded in the coming months.

Council leader David Parker welcomed the result and criticised the ICO for the fine. He said: “To issue such a high monetary penalty on a public authority in this economic climate was excessive, especially when the breach was self-reported and officers took all appropriate steps on the discovery of this incident and co-operated fully with the ICO at all times.

“Data and information security is a priority at SBC - and I am confident that the work taking place across the Council to address any issues will be acknowledged appropriately in the future.”

Tracey Logan, chief executive of SBC said: “I am extremely pleased with the outcome and have always strongly believed that the monetary penalty notice issued by the ICO in this case was unjust and disproportionate.

“Of course, I acknowledge that there were gaps in our processes in this case - but we have taken significant steps to address these since the breach to ensure data protection continues to be a high priority across the Council.

“We are committed to continue to work with the ICO to ensure our processes and policies are as robust as possible.”

ICO said that more than 600 files were deposited at the recycle bins in the Lothians area by an outside company on behalf of the council, containing confidential information and, in a significant number of cases, salary and bank account details.

The files were spotted by a member of the public who called police, prompting the recovery of 676 files.

A further 172 files deposited on the same day but at a different paper recycling bank were thought to have been destroyed in the recycling process.

The council spent over £18,000 on the appeal but the verdict from the four-day Information Tribunal vindicated its decision.