Council worker avoids jail in sensitive data breach case
Accessed confidential records of acquaintances over four days
1Abuse of position
Geoffrey Smith, an employee in Herefordshire Council's Children and Young People directorate, misused his system access to view 490 records over four days. The data included highly sensitive medical files and social worker reports concerning family members and acquaintances.
2Legal outcome
Smith pleaded guilty under Section 1 of the Computer Misuse Act 1990. Worcester Magistrates' Court imposed a 2-month suspended sentence, 120 hours of unpaid work, and £2,154 in fines and victim surcharges.
3Data sensitivity
The breached records included child protection assessments and family reports containing intensely private information. The ICO emphasized that such data should only be accessed for authorized purposes by designated personnel.
4Institutional security flaws
The incident exposed weaknesses in public sector data access controls. Experts called for stricter monitoring of employee permissions and purpose-based access logs for sensitive databases.
5Victims' rights
ICO's head of investigations Andy Curry stated citizens have a right to expect their personal data remains secure. Smith's systematic snooping could have had graver consequences given the child protection context of the accessed files.
6Public service ethics
The case reignited debates about ethical standards for civil servants. The resignation of ICO's former commissioner over similar conduct highlights the need for stronger oversight mechanisms across government bodies.