Council's data control breach leaves locals to pick up the tab after £250k fine CORREPSONDENTS to the local press in the Scottish Borders have been asking telling questions about the fairness and the purpose of the Information Commissioner's Office (ICO) levying a £250,000 fine following a data control misadventure between Scottish Borders Council (SBC) and one of its contractors. The innocent parties are the council tax payers of the Scottish Borders - but they will pick up the tab. Misadventure is at the gentler end of the descriptions they have used over the revelation that 676 paper files containing names and addresses and national insurance numbers of past employees and members of the council pension scheme were found in an overflowing paper recycling collecting bin in a supermarket car park last September. Almost half of the files also contained salary and bank details. The fine is at the high end of punishments handed out to companies or public authorities for failing in their duty under the Data Protection Act 1998 to act properly as data controllers. The ICO judgment explains its decision by spelling out that there was no contract in place between the SBC and the individual who had been digitising its paper files on an apparently ad hoc basis since 2005 and had failed at any time to establish a system for supervising disposal of the paper records once they were transferred. Indeed, the individual involved had in 2007 sent an email to the local authority asking what he should do with the files and whether the council wanted them back, but received no answer. Matthew Godfrey-Faussett, a partner at Pinsent Masons, said: "The maximum fine that can be levied is £500k and most fines we have seen up to this point have been sub£200k, so this does seem to be something of a watershed. There is no doubt that the ICO is spelling out that the issue of data protection and the secure disposal of data - no matter how well intentioned - must be increasingly high up the list of priorities of organisations around Scotland. Ken Macdonald, the ICO's assistant commissioner for Scotland, said: "We are aware of the unhappiness that follows when we impose fines. Out of the hundreds of investigations each year we have been levying fines in only a handful - ten to 20 - of the most serious cases. We also take into account the resources of the data controller; in the SBC case the fine is below 0.1 per cent of its turnover. The council tax payers will have to take that up with their council but there's no doubt data controllers have vastly improved their systems for control and supervision of outsourced services in recent years. The responsibility remains with them. SBC declined to say how much it had paid the contractor since 2005 but is considering whether to appeal against the fine. However, it will have to calculate its chances of success against the 20 per cent discount available if it pays up by 11 October.