The ICO has imposed a £120,000 fine on Surrey County Council for a serious breach of the Data Protection Act 1998, after staff sent a series of misdirected e-mails containing sensitive personal information to the wrong recipients.


In one instance, information relating to 241 individuals’ physical and mental health was e-mailed to local transportation firms.


UK Information Commissioner Christopher Graham said, “This significant penalty fully reflects the seriousness of the case…it is clear that Surrey County Council failed to fully address the risks of sending sensitive personal data by e-mail until it was far too late.”

ADVERTISEMENT

Radarfirst- Looking for clarity and confidence in every decision? You found it.