Newham Council has apologised and reaffirmed its commitment towards protecting the borough’s young people following notification today of a Monetary Penalty Notice from the Information Commissioner’s Office (ICO).
The penalty has been imposed following the inadvertent distribution of an unredacted gangs matrix by the Council in January 2017 to a group of trusted and statutory partners whose work involves preventing and detecting crime, deterring gang activity and offering appropriate support for children and young people who need it.
Parts of the unredacted information about some young people who were or were suspected of being members of gangs subsequently ended up in the public domain, though neither the Metropolitan Police nor the Commissioner have been able to establish exactly how that happened.
The Council accepts that the inadvertent distribution of the unredacted matrix was a serious administrative error. The Council accepts the gravity of the breach and deeply regrets that it happened.
The Council notes that the Commissioner’s report concludes there has been no causal connection between the distribution of the unredacted information and any incident of violence involving young people subsequent to the breach taking place.
Specific mention is made in the Commissioner’s report to the death of a 14-year-old boy in September 2017 whose name appeared on the matrix. The data breach was referenced during the Serious Case Review process into the death of the teenager, referred to as Chris. When that review was published in October 2018, Mayor Rokhsana Fiaz acknowledged lessons would be learned and changes made to practice and protocol to ensure all data is protected and held securely. In addition, the Mayor has apologised personally to the mother of the boy for the profoundly regretful data breach.
The police contacted the Council in December 2017 and the Council launched its own internal investigation which identified only the one occasion when the unredacted matrix had been distributed externally to partner organisations.
The ICO report criticises the Council for not bringing the information breach to the attention of the Information Commissioner, and its multi-agency partners. It also criticises the Council for not carrying out any investigation of its own until December 2017. The Council however was concerned about the risk of interfering with the police investigation which was then ongoing.
The Council has made changes to the management and processing of personal data to comply with data protection regulations and lessons learned from the serious data breach. This includes reviewing procedures and data sharing agreements, carrying out data impact risk assessments, the use of secure mail, mandatory training for all staff, and an independent audit of compliance with data protection law.
Mayor Fiaz said: “On behalf of Newham Council I accept the seriousness of the unredacted gangs matrix list being distributed on this single occasion in January 2017 and am sorry that it happened. While there were information sharing protocols in place at the time, clearly they could have been better. The Information Commissioner has recognised that the breach was not deliberate and we welcome that.
“Since becoming Mayor in May last year I have been embedding an enhanced culture of safeguarding across the organisation and this includes the internal control of sensitive safeguarding data in line with ICO requirements and new data protection regimes.
“The Council is committed to working with our trusted multi-agency partners to make Newham a child-centred borough where young people can feel safe and protected. The findings of the Commissioner further underlines my commitment to that.”