Laptops stolen from primaries among data lost by council

CHILDREN'S names, addresses and pictures, as well as confidential data about schools and teachers, have been lost by Devon council workers, disturbing new figures reveal.

The sensitive information was on computers stolen when being used by county council staff — in many cases when they were working at home.

District councils have lost no confidential data in the last three years.

But the Echo has discovered that Devon County Council has reported 15 instances of computer theft over the same period. In some cases the computers were known to contain confidential information on schoolchildren and council employees.

Data lost in the thefts includes:

Information on schoolchildren, including names and photographs.

Confidential data about schools and teachers.

Personal information about employees at County Hall.

Two cleaners were caught in the act of attempting to take equipment and another was dismissed following two of the thefts.

But data lost in the majority of the thefts has never been recovered.

And the council is not certain about what was contained on many of the computers.

Despite the recent publicity surrounding the loss of sensitive personal information by government departments and agencies, personal information has continued to be placed on laptops which were taken out of County Hall and subsequently stolen.

The last recorded theft took place as recently as August this year. A laptop was stolen from a car belonging to a policy manager in the council's adult and community services department.

It is thought to have contained personal information on employees, including appraisal records.

Any organisation which has regular and serious breaches of security when handling data could find itself taken to court and fined by the Information Commissioner. There is no indication this will happen to Devon County Council.

Devon is the only local authority in the area to have reported any data or computer equipment with personal information.

The Echo's Freedom of Information request reveals no losses recorded by Exeter City Council, Mid Devon District Council or East Devon District Council.

Groups representing taxpayers have criticised the "shocking" lack of care shown by council workers towards their computers.

The 15 thefts involve laptops, mobile phones, PCs and a Blackberry belonging to county council staff.

A computer with children's names and pictures was taken from a car parked in Chulmleigh; a laptop with address and personal information about young volunteers aged 16 to 18 belonging to an employee of Active Devon, a sports organisation linked to the council, was taken from their home in Torquay.

Another laptop taken from a car contained appraisal records of council staff and confidential documents about schools causing concern, written by a worker on the school improvement team, were on a laptop stolen from a home in Clyst St Mary.

Laptops have also been stolen from Stoke Hill Junior and St Leonard's School in Exeter but both schools have not given information about the data kept on them.

Police have investigated most of the thefts, which have happened between March 2006 and August 2008.

Mark Wallace, campaign director for the Taxpayers' Alliance, said: "It's shocking the council is losing so much private and confidential data on such a regular basis.

"How on earth are they going to stand any chance of protecting all the information they will have access to when the new proposed identity card database begins?

"This shows a clear cavalier attitude towards sensitive data as well as taxpayers' property."

A spokeswoman from the Information Commissioners Office said guidance was always available for organisations needing help in keeping data safe.

"It's very important to protect any personal information being held," she said.

"If any local council feels the information has been put at risk we would advise them to report this to the commissioner. We take breaches of security very seriously."

A spokesman for Exeter City Council, which has encouraged employees to work from home, said: "We have a strict IT security policy and audit arrangements in place that have been successful in maintaining data security."

A spokeswoman from the Local Government Association said the organisation would not comment on individual councils and did not produce guidance on keeping data safe.

A spokesman for Devon County Council said: "In these cases, the devices were stolen from officers, not casually lost.

"We have very clear staff guidance that potentially sensitive information should not be stored on portable devices such as laptops, even though laptops are password protected to make it much more difficult for unauthorised people to access information.

"The council is already rolling out a programme to install encryption software on all laptops and other portable devices across the whole organisation, and this will make it impossible for unauthorised people to access the data.

"We have also launched a major programme to achieve compliance with the British Standards Institute International Standard on Information Security.

"Devon County Council is one of only a small number of local authorities to take this step, demonstrating how seriously we view the security of our information.

"We are reminding schools of their responsibilities concerning management and storage of potentially sensitive information."