• Registered organisations made 2,981,958 checks in 2011
• Equivalent to 1 in 17 of adult population being checked
• 13 of the 25 highest users are private companies
• 3,924 bodies are now ‘registered’ with the Criminal Records Bureau

The figures, published under Freedom of Information law, have been highlighted by privacy and civil liberties campaign group Big Brother Watch as further evidence that the system has grown out of control.

In 2011 the organisations, which include councils, private background check companies and other businesses, made 2,981,958 checks in 2011. Thirteen of the 25 highest users are private companies.

The data shows how 3,924 bodies are now ‘registered’ with the Criminal Records Bureau and able to submit checks without the signature of the person being checked, prompting fears that the system is being used to pry into people’s privacy.

Nick Pickles, director of Big Brother Watch, said: “For nearly three million people to be checked in just one year is remarkable. It is a sad indictment of a country that has lost all sight of proportion and has substituted a piece of paper for common sense.

“Given just how many organisations now have access to the system, there is a clear risk that it is easy to delve into someone’s private life and run a CRB check without them ever knowing. 

“The checks have already been shown to wrongly brand innocent people as criminals and cost people their jobs for totally unrelated incidents that would not suggest they pose a risk. It’s time to go back the drawing board and fundamentally reform the CRB system.”

Download the full dataset here: http://www.bigbrotherwatch.org.uk/files/CRB2011.xls

Local authorities were among the highest users of the checks, but in vastly different amounts. Essex County Council was the highest user of the checks (21,908) but some councils used the service far less. The Scout Association was one of the highest users with 58,786 checks.

In comparison, the National Fostering Agency made 1613 checks while Manchester City FC made 447 checks.

Any registered organisation can now make CRB checks without requiring an applicant’s signature, prompting fears that the high numbers of checks hides those done without permission of the person being checked.

Third-parties are able to ‘register’ with the Bureau, allowing them to submit bulk applications for the checks. In January 2011 this was suspended because of fears about security and remained suspended until May 2011.

ENDS

The statistics cover the period December 18th 2010 to 18th December 2011.

More information on registered/umbrella organisations:

http://www.homeoffice.gov.uk/agencies-public-bodies/crb/partners-reg-bodies/registered-bodies/

Nick Pickles, director of privacy and civil liberties campaign group Big Brother Watch, said: “Current laws protecting our personal information were written before Google existed and an overhaul is long overdue. The proposals published today are a very positive step forward towards better protecting our privacy and giving us all the ability to ensure we retain control of our personal data.

“In a digital age, regulation is required that not only protects our privacy, but also ensures that organisations cannot hide incidents of data loss in both the public and private sector. These proposals are an important part of restoring the balance which means our data cannot be captured without our express permission, and that if we wish to cease using a service we have the right to see all our data deleted.

“It is essential that these proposals are not watered down by those who have already made clear our privacy is not going to stand in the way of their own profits.”

For release 23 November 2011:

132 local authorities lose sensitive information including details of children in care

New research from privacy and civil liberties campaign group Big Brother Watch has found how, in the past three years, local authorities have seen at least 1035 incidents of data being lost and stolen.

Key findings:

• 132 authorities involved in 1035 incidents of data loss
• At least 35 councils lost information about children and those in care
• The information of at least 3100 children, young people or students was compromised in  118 cases
• At least 244 laptops and portable computers were lost
• A minimum of 98 memory sticks and more than 93 mobile devices went missing
• Of the 1035 incidents, local authorities reported that just 55 were reported to the Information Commissioner’s Office.

Just 9 incidents resulted in termination of employment.

Download the report here.

Despite delivering sensitive services involving children, vulnerable people and those in receipt of various benefits, the research highlights how regularly personal information is lost by local authorities and the huge variation in data protection.

Nick Pickles, director of Big Brother Watch, said: “This research highlights a shockingly lax attitude to protecting confidential information across nearly a third of councils. The fact that only a tiny fraction of staff have been dismissed brings into question how seriously managers take protecting the privacy of their service users and local residents.

“For more than 3,000 children and young people to have their personal information compromised is deeply disturbing, as in most cases parents will not be aware of the incidents. However, equally concerning is that 263 local authorities claim to have not lost a single mobile phone or memory stick, which seems surprising given the scale of loss in other authorities and the private sector.

“As just 55 of these incidents were reported to the Information Commissioner’s Office, there is a clear need for the ICO to have the power to audit organisations without needing their consent to ensure that the ICO is fully aware of data protection breaches.

“Despite having access to increasing amounts of data and being responsible for even more services, local authorities are simply not able to say our personal information is safe with them.”

91% of local authorities responded to the Freedom of Information request, which covered loss of personal information by council employees and contractors between 3 August 2008 and 3 August 2011. However, the group questioned the responses of a number of authorities which reported no incidents suggesting different internal thresholds for reporting meant incidents could be hidden from scrutiny.

The report comes a month after Big Brother Watch’s disclosure that in the NHS more than 800 incidents of confidential patient records being compromised, including details of patients being posted on social networking sites and how medical staff looked at the records of friends and colleagues.

It also follows the Commons Justice Select Committee report that argued courts should have the power to punish people breaching the Data Protection Act with prison sentences, saying fines are an “inadequate” deterrent.

Cases included an unencrypted memory stick containing highly confidential childcare data being lost on a Durham Street, a Kensington and Chelsea council employee losing documents in a pub including name, address, date of birth, health reports, income reports and photographs of service users and scanned case notes belonging to Kent Council being found on Facebook.

They also included a 50 page dossier from Northamptonshire Children and Young People’s Services sent to the wrong parent, a briefcase left in a car park containing caseworker notes of approximately 20 service users, Buckinghamshire County Council revealing 2,000 email addresses in a public mailshot and a North Somerset email account being compromised in a phishing attack.

The top ten worst offending authorities were:

1. Buckinghamshire (72 incidents)
2. Kent  (72)
3. Essex (62)
4. Northamptonshire (48)
5. North Yorkshire                (46)
6. Renfrewshire (41)
7. West Sussex (36)
8. Tower Hamlets (31)
9. Telford and Wrekin (30)
10. Cornwall (25)

Download the full report here.

Commenting on the Information Commissioner’s survey into attitudes around the Data Protection Act and Freedom of Information Act, Nick Pickles, director of privacy and civil liberties campaign group Big Brother Watch, said:

“The Data Protection Act is 13 years old and it is staggering that in both the public and private sectors, the majority of organisations still do not understand their obligations under the Act.

“Personal information is a critical part of protecting our privacy in a digital age. With instances of personal information being lost or accessed inappropriately continuing to rise, up 58% in the past year, Government needs to do far more to ensure privacy is protected with adequate legal safeguards.

“This survey highlights the failure of the ICO to create a clear and robust system for protecting information, and reaffirms the need for tougher sanctions and a much greater effort to enforce the law.”

Commenting on today’s report from the Joint Committee on the draft defamation bill, Nick Pickles, director of privacy and civil liberties campaign group Big Brother Watch, said: “Libel law as it stands is clearly not functioning properly, and is certainly not fit for a digital age.

“If people are posting defamatory material, publishers have a duty to remove that content. What is essential is that any take down process must follow due process and ensure that the law cannot be abused by larger parties to censor uncomfortable content – as is often the case under existing law.

“It is essential that the ability to post and publish anonymously online is protected and this report does not go far enough to explain how this can be done.”