A Council has been fined £100,000 after highly sensitive papers about a child sex abuse victim were stolen from a London pub.
A social worker was taking home the papers - which also included information about six other people connected to a court hearing - to use in a meeting the next day when the unlocked bag was stolen. It has not been recovered.
The Information Commissioner's Office found Croydon council had breached the Data Protection Act by not implementing appropriate security measures for handling sensitive data.
The ICO said Croydon had made data protection guidelines available to staff at the time of the theft last April, but had failed to check that the information had been read and understood.
It said the policy did not stipulate how sensitive information should be kept secure out of the office.
Stephen Eckersley, head of enforcement at the ICO, said: "This highly personal information needn't have been compromised if the council had appropriate security measures in place."
Croydon said it would now provide special locks to ensure sensitive material was secure. However, it added that it was "perplexed and frustrated" by criticism of its data protection and information handling guidelines.
A spokesman said: "Taking into account that this was a single breach, there has been no complaint by any party, the extent of the procedures we already had in place, and the extensive steps taken by the council even before the ICO's ruling, we are considering whether there are grounds for appealing against what we believe to be an excessive and unjustifiable amount."
