Information security incident reporting

There is an information security incident notification process in place for Services/Resources to report any information security incidents to the  Information Governance Board.

Examples of information security incidents involving confidential information (regardless of whether in paper or electronic format) could be:

• Loss or theft of information or, if held electronically, equipment on which data is stored
• Records  being destroyed by mistake
• Inappropriate access controls allowing unauthorised use
• Items going missing during transfer
• Human error – e.g. items being sent in error to the wrong person
• unforeseen circumstances such as fire or flood or equipment failure
• Hacking attack or
• Information obtained from the Council by deceiving the Council - blagging

Where the security incident includes personal data, the information provided in the information security incident notification form will be considered when making a decision as to whether to report a security incident to the Information Commissioner.  Employees should liaise with their line manager with regard to reporting information security incidents to the Information Governance Board.

When do Resources notify incidents?

Due to new data protection legislation which will come into force in May 2018, we have revised the Council’s Information Policy and procedures for notifying us of information security incidents. The new policy and procedures create new obligations including a maximum time limit for Resources to notify issues to the Information Governance Board (IGB) and the Data Protection Officer (the DPO) where the incident involves information about people.

In terms of the revised procedures, your Resource, through its Resource Contact Officer (RCO), must alert the Council’s Information Governance Board (the IGB) through the Data Protection Officer (DPO) of any incidents within 48 hours of the incident coming to light. We cannot wait until Resources have carried out an investigation into whether they are sure there has been an incident before notifying. This must be done as soon as it appears likely that something has gone wrong.

The procedure for the Contact Officer to follow can be found here  - information incident reporting

Your responsibilities

1. Be aware that it is very serious if confidential information is lost (even where it was only outwith the control of the Council for a short while) or  misused (such as inappropriate access). This can include confidential information inadvertently being sent in error to the wrong person either by post or by email.
2.  Report any general concerns you have about confidential information security to  

•  Your Line Manager (regardless of whether the confidential information is/was in paper or electronic format) and
•  IT Helpdesk (01698 455656) (if the confidential information was held in electronic format)

     3.   Report, immediately, any situations where it is likely that there has been a confidential information security incident (including “near misses”) especially where it involves the personal information of other people to

•  your line manager and
•  your RCO, who will notify the IGB and the DPO of the incident. Your Resource will put in place its own arrangements for the internal notification of incidents to the relevant Contact Officer. These arrangements will be notified to you by your Resource.

The RCOs in each Resource are

Name  Anne Lewis (Community and Enterprise Resources)
Email  anne.lewis@southlanarkshire.gov.uk

Name  Margaret Mary Wilson (Finance and Corporate Resources)
Phone 01698 454501
Email  margaretmary.wilson@southlanarkshire.gov.uk

Name  Molly Magee (Education Resources)
Phone 01698 454512
Email  molly.magee@southlanarkshire.gov.uk

Name  George Ritchie (Housing and Technical Resources)
Phone 01698 453783
Email  george.ritchie@southlanarkshire.gov.uk

Name  Wendy Cranston (Social Work Resources)
Phone 01698 453727
Email  wendy.cranston@southlanarkshire.gov.uk