Information security

In December 2017 the Executive Committee approved a revised version of  South Lanarkshire Council's Information Security Policy.  This policy provides a basis on which to build our local procedures.   It is important for us to look after the information we gather on behalf of our customers in an appropriate manner, ensuring its security, its accuracy and making sure it is retained for the correct period of time. 

Data Protection Considerations

We have a number of duties under the Data Protection Act 1998 to protect any personal and sensitive data we collect and use.   We have a duty of care to protect the confidentiality on behalf of the data subject (i.e. the person who the information is about)

At the core of South Lanarkshire Council's privacy policy are the rights of the people whose information we collect, use and process in order to provide a service.  The consequences of what might happen if we were to lose or misplace an individual's information should be at the forefront of our procedures.

Information Security Incidents

The Council has introduced an information security incident notification procedure.  See Information security incident reporting for further information. 

Paper files and records

When dealing with paper information there are many security precautions you need to take into consideration.

Clear desk

Don't leave files containing personal and sensitive data lying on your desk as you never know who will accidently access information which they shouldn't be party to.

Keep personal data, personal and sensitive data and confidential information in secure locked filing cabinets and cupboards.  Make sure that access to the keys to these cupboards and cabinets are controlled.

Going to meetings

When attending meetings in another location, assess whether or not you need to take an entire file with you.  Only take the papers that are necessary for the meeting.  Remember that while the file is with you, it is your responsibility. The same considerations apply to personal working papers or notes.  Use a file case or lockable briefcase so that if you were to drop the case your papers will stay intact.

Introduce a file signing out and signing in procedure in your team so that everyone in the office will be aware of the location of a file and who has responsibility for it at any time or use a file marker system leaving a marker in the file where papers have been temporarily removed.

Travelling on Public Transport

When travelling on public transport such as on a train journey, never leave your papers unattended and try to make sure that any sensitive or confidential information is shielded from prying eyes. Make sure you don't leave any papers or brief cases behind.

Taking files home

Every moment a file is out of the office is a moment when it is at risk of being lost, stolen or misplaced. Permission for home working should always be cleared with your line manager.   If you are working at home or have to take files home with you overnight then make proper arrangements for them while they are in your care.  
Don't leave them visible in your car.  While transporting the files keep them out of sight in the boot. 
Don't store paper files along with a laptop.  A laptop is a magnet for a thief.  Keep the paper files separate.
In your home, don't leave files on a hall table in full view of family members, visitors or potential intruders.  Do keep them in a secure container or brief case out of sight - e.g. in a hall cupboard.

Transporting files from building to building

It is important to take care when transporting files from one building to another.  Think about who will have access to these files while they are in transit. 
Consider using a sealed envelope which will show if files have been tampered with during transit.
Don't send personal and sensitive files via internal mail, consider hand delivering.
Always package and label your files appropriately, clearly address all items, and take extra care when transporting personal and sensitive data.

Sending files by post

Avoid sending personal and sensitive data by the external mail system but if it cannot be avoided then consider using a courier service or signed for mail delivery in order to ensure receipt.  Make sure correspondence containing personal and sensitive data is correctly addressed and sent in a sealed envelope which is robust enough to take the contents so that it doesn't come apart in the mail.   Also make sure that a return address is added to the back of the envelope so that mail will be returned to South Lanarkshire Council if there is a problem with the recipient's address.

Emailing or faxing sensitive information

When emailing or faxing sensitive information it is good practice to make advance contact with the recipient before transmitting.   Always check the email address and/or fax number in advance.  Make an arrangement for the recipient to be waiting at the fax machine to receive the fax and to confirm receipt by telephone.   Ask an email recipient to confirm receipt of the email either by return email or by phone. 
When sending personal and sensitive information by email to another public organisation use the @southlanarkshire.gov.uk suffix on your emails to ensure that they are sent via the public secure network (PSN).