Answers to your data loss questions
On 29 March 2010, we wrote a letter 
(PDF:36KB) to parents and young people regarding an incident about the loss of data relating to some children and young people at Barnet schools in recent years.
Data security – questions and answers
1. Was data relating to me or my child lost?
If you have received a letter you, your child or one of your children was involved.
2. Which children’s data was lost?
The data lost relates to children who were at a Barnet school in year 11 in 2006/7, 2007/8 and 2008/9.
3. How was this lost?
Encrypted computer equipment and some unencrypted storage devices (USB memory sticks and CDs) were stolen from a member of staff’s home in a domestic burglary. The encrypted computer equipment is secure. (The council follows procedures recommended by the Government’s National Technology Authority for Information Assurance.)
The CDs and memory sticks were unencrypted, a breach of council policy.
4. When did this happen?
Earlier this month.
5. What data was lost?
If you have received a letter with reference 2903c, 2903d or 2903j the data items lost were: surname, forename, gender, date of birth, postcode, UPN (a unique identification number), ethnicity, free school meals eligibility, in-care indicator, language, gifted and talented indicator, mode of travel to school, entry date to school, special educational needs indicator, school, attainment data for English, maths and science at end of years 6 and 9, attendance rate.
If you received a letter with reference 2903a, 2903b or 2903i the data items lost were: surname, forename, gender, date of birth, address, postcode, telephone number, UPN, ethnicity, free school meals eligibility, in-care indicator, language, gifted and talented indicator, mode of travel to school, entry date to school, special educational needs indicator, school, attainment data for English, maths and science at end of years 6 and 9, attendance rate.
6. Why did this member of staff have this information?
It was held for statistical purposes comparing trends amongst all students with the school performance of the children with which they were working.
7. Why is this information collected?
It is collected by Barnet Council on behalf of the Department of Children, Schools and Families. It is used to track the performance of broad groups of children through the education system.
8. Does this put me or my child at risk?
We believe that the risks associated with this data loss are very low.
The advice we have received from the police indicates that this was an opportunistic burglary looking for high-value items rather than specifically to steal data. This assessment of the risk has involved taking advice from the police and staff trained in safeguarding children from within the council.
Our safeguarding team felt there may be risks associated with the potential identification of one child. This issue has been dealt with.
9. Why are you telling me?
Although we believe the risk is very low we take our responsibility to manage your data very seriously. A breach has occurred and it is our responsibility to tell you what has happened and what we are doing to improve our processes to ensure it doesn’t happen again.
10. Why has taken several days to tell me?
Our safeguarding team have been undertaking a full risk assessment to identify any child protection issues that this breach could create, before communicating with anyone for whom we have assessed to be at low or no risk.
11. How do you know other information was not lost?
Access to pupil level data is controlled and we know this member of staff did not have access to any more information and therefore they can not have lost anything further. This has been verified via our IT systems.
12. How many people were covered by the lost data?
We have informed approximately 9,000 people that their data has been lost.
13. I have not received a letter but think I may be in the group whose data was lost. Was my data lost?
It is unlikely but contact the council on the helpline number and staff can advise you.
14. What has the council done to stop this happening again?
We, the council, has disabled any access to external storage devices so no member of staff can make unauthorised copies in the future. All computers leaving the council offices have to be confirmed as encrypted.A full independent review of how the council holds data has been ordered.
15. Did the data contain anything that would enable someone to steal my identity?
We are advised this is very unlikely, as to steal an identity requires detailed documentary evidence.
16. What precautionary measures should I take?
There are no precautions that can be taken, but you should remain vigilant for any irregular activity you may identify relating to you around areas such as benefit.
17. How do I know if someone has used my data? What should I do if they do?
In the very unlikely event that someone does use this data, it would become evident through an irregular activity you might identify relating to you around an area such as benefits. If this does happen, you should report it to the police and the relevant organisation.
18. I want the details that have been lost about my child/me
We cannot give out personal details about a child without a series of checks. If you want to know the details of the information we believe has been lost about you or your child you will therefore have to apply in writing using a process called a Subject Access Request.
This process is a requirement of the Data Protection Act and is a formal process we must follow.
In order to do this you must send an email to foi@barnet.gov.uk saying you wish to make a Subject Access Request.
You will then be sent a pack explaining what you need to do to make the request, which includes verifying your identity and your right to access the information.
If you do not have an email address please telephone 020 8359 2000.
19. Has the council stopped staff taking laptops out of council offices?
No. The data loss is not as a result of the theft of a council laptop, it is the result of taking unencrypted data stored outside of computers. Many council staff, including those working with schools, have work that takes them out of the office and the use of laptops helps them carry out that work efficiently.
Because the council has disabled USB ports and prevented data copying on council computers staff cannot make unencrypted copies of data, as happened in this instance.
20. Why was this data stored on a laptop?
It wasn’t. The data is stored on the council’s mainframe computers and can only be accessed by an encrypted council computer. In this instance data had been stored, against council policy and procedures, on unencrypted cd-roms and memory sticks.
The council has now shut down data copying devices on council computers to prevent this happening again.
21. Is any more information available? Can I speak to someone about this?
If you want any more information, please:
- Tel: 020 8359 7599
- TypeTalk (Deaf): 18001 020 8359 7599
- Email: barnet.first@barnet.gov.uk
A team of staff will be available to answer any questions you may have. Please be aware they will not be able to tell you any detail of the data that has been lost. The phone numbers will be answered between:
- 9am and 8pm, Tuesday 30 March
- 8am to 8pm, Wednesday 31 March
- It will run from 8am to 5pm on 1 April.
Email this pageLast modified by: Mike Godleman on 07/04/2010