COUNCIL bosses have been blasted for repeatedly failing to train their staff on "basic" data protection - leading to a child's adoption papers being stolen.

In a blistering decision, the Information Commissioner's Office (ICO) condemned West Dunbartonshire Council for not training their staff and dragging their heels for three years.

The council could now face court action under an enforcement notice to do the work they were told to do back in 2013.

All staff must be trained within six months with refresher training on an annual basis, ordered the ICO.

Ken Macdonald, Assistant Information Commissioner for Scotland, said: “Time and time again we have told this council to make these changes, and yet they have still not completed everything we set out. We’ve been left with no choice but to issue this formal notice requiring them to act.

“Let’s be clear, what we’re asking for here is a basic requirement for an organisation that is trusted with large amounts of local people’s personal data. When people in Dunbartonshire provide the council with their details, they expect staff are trained to handle this information properly. Unfortunately, more than three years after this was made clear to the council, this still hasn’t happened.”

Management were told to impliment training and guidance on home working for staff after an audit back in January 2013.

But a follow-up in November 2013 found some recommendations hadn't been implemented.

On July 21, 2014 the council reported a data breach to the ICO when an employee had a bag with confidential information stolen.

The worked had details of an adoption case out of the office to work on from home but the laptop and paperwork left in their car overnight were stolen.

In a statement, the ICO explained: "An ICO investigation found the employee had not been given training on the Data Protection Act, and the council still had no guidance to staff on handling personal information when working from home. The council avoided a fine as the breach did not cause substantial damage or distress."

West Dunbartonshire Council apologised for the error but said they were disappointed in Mr Macdonald's language while they considered an appeal.

A council spokesman said: "West Dunbartonshire Council would like to apologise for this error. We take data protection seriously and referred ourselves to the Information Commissioner as soon as this breach took place.

"We are disappointed at the language used by Mr Macdonald, particularly as this comes during the period open to appeal - something the council is currently considering."

As well as mandatory training, the council was ordered to ensure it was properly documented and monitored and a new home working policy introduced for staff who work remotely. That should also cover the security of equipment.