Charitable Organization Penalized for Diatomacing Auxiliary Documents of Incalculable Importance

In a recent development, the Information Commissioner's Office (ICO) has imposed a fine on the charity Birthlink for the destruction of thousands of personal records. The violation occurred due to systematic failings that led to the destruction of records containing deeply personal pieces of an individual's history.

Birthlink, a post-adoption support and advice organisation, has owned and maintained the Adoption Contact Register for Scotland since 1984. However, in 2021, the charity began destroying "Linked Records", which include handwritten letters, photographs, and copies of birth certificates. Despite the board's ruling that only replaceable records could be destroyed, the charity's record keeping, compliance with data protection law, and staff training and awareness were poor, causing the cull to exceed limits.

The ICO argued that this case underscores the importance of data protection, emphasizing its impact on individuals' lives. Sally Anne Poole, head of investigations at the ICO, stated, "The case serves as a reminder that data protection is about people and the far-reaching effects of a data breach."

The violation led to the destruction of approximately 4,800 personal records, some of which may now be lost forever. The ICO estimates that up to 10% of these files may have been irreplaceable. These records had the potential to contain memories, identity, a sense of belonging, answers, and more.

The UK Home Office also committed a major data protection error by systematically destroying 4,800 personal recordings in August 2023. The ICO announced a potential fine of up to £17.5 million for this breach.

In response to the issues, Birthlink has taken several steps to address the situation. They have digitally recorded and stored all physical records, appointed a data protection officer, and started a staff training program.

Initially, Birthlink was facing a financial penalty of £45,000. However, the ICO reduced the penalty after considering the charity's representations.

This incident serves as a stark reminder of the importance of data protection, particularly in organisations that handle sensitive personal information. The ICO encourages all organisations to prioritise data protection, ensuring the privacy and security of individuals' personal data.