This article is from the source 'bbc' and was first published or seen on . It last changed over 40 days ago and won't be checked again for changes.

You can find the current article at its original source at http://www.bbc.co.uk/news/uk-wales-26775603

The article has changed 3 times. There is an RSS feed of changes available.

Version 0 Version 1
Welsh councils broke data protection laws 135 times Welsh councils broke data protection laws 135 times
(about 2 hours later)
Councils in Wales broke data protection laws twice as often last year as they did in 2012, BBC Wales has learned.Councils in Wales broke data protection laws twice as often last year as they did in 2012, BBC Wales has learned.
Examples included a bag containing papers for a court case being left on a train, and sensitive personal data appearing on a website.Examples included a bag containing papers for a court case being left on a train, and sensitive personal data appearing on a website.
The laws were broken 135 times in 2013 compared to 60 breaches in 2012.The laws were broken 135 times in 2013 compared to 60 breaches in 2012.
The Information Commissioner's Office (ICO) called for effective data handling to be "hardwired" into the culture of local authorities.The Information Commissioner's Office (ICO) called for effective data handling to be "hardwired" into the culture of local authorities.
Five of the 22 councils said they had recorded no breaches last year.Five of the 22 councils said they had recorded no breaches last year.
BBC Wales obtained the details through a Freedom of Information request.BBC Wales obtained the details through a Freedom of Information request.
In 2013 Cardiff council recorded 14 breaches. Examples included: In 2013, Cardiff council recorded 14 breaches including financial information about 15 employees was given to third parties and information being stolen from an employee's car, who was later disciplined.
Cardiff Council said: "The council has introduced a number of new measures during the past 12 months to ensure that we continue to comply with the requirements of the Data Protection Act, privacy and electronic communications regulations and other relevant information governance and security legislation". A council spokesperson said a number of new measures have been introduced during the past 12 months.
There were 45 incidents in Powys council of which 25 were confined internally to the council, four were due to external providers of services and six were still under investigation.There were 45 incidents in Powys council of which 25 were confined internally to the council, four were due to external providers of services and six were still under investigation.
In a statement the council said where "external unauthorised disclosures had occurred the council has taken a number of steps including training, revision of policies and further roll out of encrypted laptops". The council said it has "taken a number of steps including training, revision of policies and further roll out of encrypted laptops".
In Wrexham council, there were 13 incidents, including one in the adult social care department where personal information was passed incorrectly to a third party. At Wrexham council, there were 13 incidents, including one in the adult social care department where personal information was passed incorrectly to a third party.
Four "minor" incidents were investigated in the children and young people prevention and social care department. In addition the council failed to respond to requests for information under the act within the required 40 calendar days on eight occasions.
In Gwynedd council there were 10 breaches, including personal details being mistakenly sent, and letters and emails being sent to the wrong people.In Gwynedd council there were 10 breaches, including personal details being mistakenly sent, and letters and emails being sent to the wrong people.
Flintshire council recorded nine breaches, including a fax containing personal data being sent to the wrong care provider, and a customer receiving someone else's personal data.
'Disclosed in error''Disclosed in error'
Flintshire council recorded nine breaches, including a fax containing personal data being sent to the wrong care provider, and a customer receiving someone else's personal data.
Nine incidents were recorded in Newport council - eight incidents were classified as "disclosed in error" and there was one case of "lost or stolen paperwork".Nine incidents were recorded in Newport council - eight incidents were classified as "disclosed in error" and there was one case of "lost or stolen paperwork".
Caerphilly council confirmed that six breaches had occurred. Among them, an incorrect decision was made on the disclosure of a person's personal data to a third party, and one person's personal data was lost within the authority. Caerphilly council said six breaches had occurred including an incorrect decision was made on the disclosure of a person's personal data to a third party, and one person's personal data was lost within the authority.
There were five breaches in Anglesey. A bag containing papers for a court case was left on a train, documents were stolen from a private residence, and a letter, fax and email were sent to the wrong people. There were five breaches at Anglesey council including a bag containing papers for a court case being left on a train, documents stolen from a private residence, and a letter, fax and email were sent to the wrong people.
Carmarthenshire council failed to answer five requests for information within 40 days. In two of these cases, further information came to light that should have been supplied with the response to the request.Carmarthenshire council failed to answer five requests for information within 40 days. In two of these cases, further information came to light that should have been supplied with the response to the request.
In Bridgend council, three breaches took place: Bridgend council had three breaches including a laptop being stolen from a car and a document containing sensitive personal data being sent to the wrong printer.
Monmouthshire council said that there "were no significant breaches in 2013". The authority is aware of "three occasions when encrypted laptops were stolen, with a very small risk of data loss. There was also an occasion where a small amount of personal data was incorrectly sent to a solicitor and promptly returned, resulting in no damage". Monmouthshire council said there "were no significant breaches in 2013" while Conwy council said "some events occurred which included sending emails, a fax and correspondence to unintended recipients, and information stolen from a vehicle/property".
In Conwy, "some events occurred which included sending emails, a fax and correspondence to unintended recipients, and information stolen from a vehicle/property". There were four breaches at Merthyr Tydfil council along with two at Pembrokeshire and three at Denbighshire.
There were four breaches in Merthyr Tydfil council. On two occasions incorrect details remained on a form, and two letters were sent to an incorrect address. Rhondda Cynon Taf council self-reported one breach to the ICO about disclosing personal information through email by accident and Torfaen council had one breach which was an email with personal information sent to the wrong recipient.
The act was breached three times in Denbighshire. A letter was sent to the wrong person, documents were passed to the wrong service user and a letter sent to the wrong house.
In Pembrokeshire, there were two breaches.
Information was included in a childcare subject access request that related to other children who were not part of the request. This resulted in disciplinary action, new procedures being put in place and a new employee to deal specifically with subject access requests for childcare, adult services and education.
Also a member of staff was disciplined for accessing information about another person "in relation to jobs they had applied for" without the authority to do so.
Rhondda Cynon Taf council self-reported one breach to the ICO about disclosing personal information through email by accident.
Torfaen Council had one breach which was an email with personal information sent to an incorrect recipient.
There were no breaches in 2013 in Blaenau Gwent, Ceredigion, Neath Port Talbot, Vale of Glamorgan and Swansea.There were no breaches in 2013 in Blaenau Gwent, Ceredigion, Neath Port Talbot, Vale of Glamorgan and Swansea.
Anne Jones, Assistant Information Commissioner for Wales, said: "It's important local authorities live up to their legal responsibilities under the Data Protection Act. Anne Jones, Assistant Information Commissioner for Wales, said: "Keeping people's personal information secure should be hardwired into their culture as losses can seriously affect reputations and as a consequence, service delivery".
"Keeping people's personal information secure should be hardwired into their culture as losses can seriously affect reputations and as a consequence, service delivery".