The ICO's Birthlink Fine: Accountability, Integrity, and the 'Public Sector Approach' (?)

Last week, the ICO fined Scottish charity Birthlink £18,000 for destroying around 4,800 adoption records. In this video, Rob explains why this is such an interesting case.

Birthlink is an Edinburgh-based charity that maintains the Adoption Contact Register for Scotland. It provides specialised support for people involved in adoptions.

At the heart of this case are the "linked records": Manual paper files created when a successful link had been made between individuals on the adoption contact register. 

The linked records included original birth certificates, handwritten letters from birth parents to their children, photographs of babies, and other very sensitive personal data.

In April 2021, a decision was made to create more space in the filing cabinets. Birthlink destroyed the linked records in question. 

This allegedly happened with no formal board approval, no data retention or destruction policies in place, no data protection training for the staff that made the decision, and no records kept of exactly which files were destroyed.

The ICO shaved down a £45,000 fine (from the notice of intent) to £36,750 and then £17,000. 

Confusingly, the monetary penalty notice suggests the Commissioner approached the fine calculation in the same way as it would when enforcing a public body, but the ICO has since said it did not apply its controversial "public sector approach" (as it did against the YMCA last year).

Either way, there are some important lessons here, particularly on accountability, data integrity, and the "storage limitation" principle.

Get in touch: [e-mail]