CROYDON Council has been fined £100,000 after a bag containing papers relating to a child sex abuse victim was stolen from a pub.

The Information Commissioner's Office (ICO) ruled the authority had breached the Data Protection Act because it had failed to have the appropriate security measures in place to protect the extremely sensitive data.

However, the council has criticised the 'perplexing' ruling, describing the fine as 'wholly disproportionate', and said it would now consider whether to appeal.

The breach occurred when an unlocked bag belonging to a social worker, who is still employed by the council, was stolen from a London pub in April 2011.

Documents included information about the sexual abuse of a child and six other people connected to a court hearing.

The had been taken home for use at a meeting the following day.

The bag and its contents have never been recovered.

Stephen Eckersley, the ICO’s head of enforcement, said: "We appreciate that people working in roles where they handle sensitive information will – like all of us – sometimes have their bags stolen.

"However, this highly personal information needn’t have been compromised at all if Croydon Council had appropriate security measures in place."

The ICO’s investigation found the council did not 'actively communicate' data protection guidance to its staff at the time of the theft, and failed to monitor whether it had been read and understood.

It described the council’s policy on data security as 'inadequate', and said that it did not stipulate how sensitive information should be kept secure when taken outside of the office.

The council said its 'extensive procedures and protocols' should have prevented the situation from arising, adding that such security measures appeared not to have been taken into account by the Commissioner.

A spokesman added: "For transfer of electronic data, the council already insists on use of encrypted devices.

"However, there are exceptional circumstances, including court work, where hard copy files have to be carried by staff.

"We are therefore now going to provide and then mandate the use of special locks to ensure this material is also secure, even if the bag is stolen.

"However, the council is perplexed and frustrated by the Commissioner’s general criticism of our data protection and information handling guidance, as many of our internal measures and policies appear to have been disregarded in reaching this judgement.

"The council also believes, having taken advice, that the level of fine is wholly disproportionate to the breach.

"This is based on a comparison of fines levied in other data protection cases, taking into account that this was a single breach, that there has been no complaint by any party, the extent of the procedures we already had in place, and the extensive steps that were taken by the council even before the ICO’s ruling.

"We are therefore considering whether there are grounds for appealing against what we believe to be an excessive and unjustifiable amount."

For more on this story see the latest edition of the Croydon Advertiser, out Friday (February 17).