Photos of bank cards stored on Manchester council systems created 'critical' security risk, report finds
Audit committee report says images were kept so staff could verify people's bank details
Manchester council created a data security issue of its own making by saving images of people's bank cards on systems and communications channels used by staff, according to a new report.
The report, from the council's audit committee, said pictures of bank cards were being saved on its systems so staff could verify people's bank details when needed.
It warned the images created a 'critical' and 'avoidable' data security risk, and urged the council to stop saving them.
The report section was focused on payments to individuals for children's social care.
Data security risk
Images of bank cards could be seen by 'all social workers for that locality, business support and the relevant finance officers', according to the audit report.
The report said: 'We notified the business support lead of our concerns early in the audit and supported a meeting to identify alternative methods of verifying citizens' bank details.'
It continued: 'Since this meeting, the business support lead has confirmed that card images are no longer accepted and have been removed, however in completing a follow-up check we identified several instances where bank card details were still being stored.'
The report said there is an 'ongoing data security risk' from the incident, as well as a 'lack of compliance with the payment card industry data security standard'.
The audit covered the period between 15th May and 15th September this year.
Council's response
A Manchester council spokesperson said: "The issue about the retention of some bank card details was identified and management action taken to address it, although at the time of audit it was noted that a small number of records remained to be removed.
"These have all since been removed and there is no evidence that the information was accessed beyond its legitimate use by the team who were collating and retaining it."
ICO involvement
The council was asked at its audit committee meeting on 13th October if it had referred itself to the Information Commissioner's Office over the issue, but a town hall official was not able to confirm at the time whether that had happened.
The ICO said on Friday (16th October) that it had not received a report from the council about the matter. It explained that not all data breaches are personal data breaches, and not all personal data breaches need to be reported to it.
Councillor's concerns
Lib Dem councillor Richard Kilpatrick, who sits on Manchester council's audit committee, said he has concerns about how the town hall has handled the situation.
He told the Local Democracy Reporting Service: "I'm concerned there's a culture of not referring when they know that they've done something wrong, even though it is absolutely in the interest of the council once a mistake has been made to accept it made a cock-up and investigate it properly."
Other issues identified
The audit also found issues with record-keeping at the council, with instances of payments which 'appeared to be to citizens were actually staff expense reimbursements being processed through petty cash'.
A Manchester council spokesperson added: "The role of the council's internal audit service is to identify, review and act on areas where improvements are required. In any organisation as large and complex as the council, effective audit work should be identifying issues to address, focusing on areas for improvement rather than known strength. That is reflected in these findings.
"As part of our commitment to transparency and accountability, we publish substantial details of audit work which are discussed in public in our audit committee. This is more than many other councils do and means there is openness about where we must do better.
"A payments audit in children's services identified areas for improvement in record keeping and ensuring advance approval of purchases, with actions agreed to ensure these issues were addressed."