DPA case Nottinghamshire County Council – Violation Found (United Kingdom, 2023)

Nottinghamshire County Council is the data controller. It has a service called Council Assessment Service (CAS), which prepares Child and Family Assessments (CFA). CFA is prepared by social workers and looks into the well-being of children where there are concerns regarding the capacity of their parents or caregivers to take proper care. The data subjects are the users of CAS and the children whose well-being is assessed. A social worker who had prepared the CFA sent out an unredacted copy of the assessment report of two children to their mother and her two ex-partners, each father of one of the children. The assessment report contained sensitive personal data, which should have been redacted from the copies sent to the ex-partners of the mother. Before sending, the assessment report was required to be signed off by the manager, who also did not look into the same, resulting in the distribution of unredacted copies. Before this incident, 16 incidents of unredacted information being shared had occurred at Nottinghamshire County Council. The ICO held that the manager's oversight procedure was not sufficiently robust, as evident from the failure in this case. Also, Nottinghamshire County Council had not provided detailed training to its staff on redaction. The ICO held the breach to be serious as it could have resulted in actual physical harm to the mother and the children, given that it pertained to domestic violence carried out on the mother and children. The ICO took note of the remedial steps taken by Nottinghamshire County Council, including comprehensive guidance in relation to the redaction of documents, and after taking into account all relevant materials and facts, reprimanded Nottinghamshire County Council under Article 58(2)(b) (UK) GDPR, for infringing Article 32(1) (UK) GDPR.