A report from Manchester council's audit committee has revealed that images of people's bank cards were being saved on its systems and communications channels used by various members of staff, creating a 'critical' and 'avoidable' data security risk.
The pictures were saved so that staff members could verify people's bank details when needed. The audit report urged the council to stop saving such images, which it described as a 'critical' and 'avoidable' data security risk over the information.
Payments to individuals for children's social care
The report section was focused on payments to individuals for children's social care. The audit covered the period between May 15 and September 15 this year.
A council spokesperson said: “The issue about the retention of some bank card details was identified and management action taken to address it, although at the time of audit it was noted that a small number of records remained to be removed.
“These have all since been removed and there is no evidence that the information was accessed beyond its legitimate use by the team who were collating and retaining it.”
ICO referral questioned at audit committee meeting
The council was asked at its audit committee meeting on October 13 if it had referred itself to the Information Commissioner's Office (ICO) over the issue, but a town hall official wasn't able to confirm if that had happened at the time.
The ICO said on Friday (October 16) that it hadn't had a report from the council about the matter, but it explained that not all data breaches are personal data breaches, and not all personal data breaches need to be reported to it.
Lib Dem councillor Richard Kilpatrick sits on Manchester council's audit committee and said he has concerns about how the town hall has handled the situation. He told the Local Democracy Reporting Service: “I'm concerned there's a culture of not referring when they know that they've done something wrong, even though it is absolutely in the interest of the council once a mistake has been made to accept it made a cock-up and investigate it properly.”
Ongoing data security risk
Images of people's bank cards could be seen by 'all social workers for that locality, business support and the relevant finance officers', according to the audit report.
The report continued: 'We notified the business support lead of our concerns early in the audit and supported a meeting to identify alternative methods of verifying citizens' bank details.
'Since this meeting, the business support lead has confirmed that card images are no longer accepted and have been removed, however in completing a follow-up check we identified several instances where bank card details were still being stored.'
The report said there is an 'ongoing data security risk' from the incident, as well as a 'lack of compliance with the payment card industry data security standard'.
It also found issues with record-keeping at the council, with instances of payments which 'appeared to be to citizens were actually staff expense reimbursements being processed through petty cash'.
A Manchester council spokesperson added: "The role of the council's internal audit service is to identify, review and act on areas where improvements are required. In any organisation as large and complex as the council, effective audit work should be identifying issues to address, focusing on areas for improvement rather than known strength. That is reflected in these findings.
As part of our commitment to transparency and accountability, we publish substantial details of audit work which are discussed in public in our audit committee. This is more than many other councils do and means there is openness about where we must do better.
A payments audit in children's services identified areas for improvement in record keeping and ensuring advance approval of purchases, with actions agreed to ensure these issues were addressed."
