Council audit flags “critical” data security risk over bank card photos held in shared Teams folders

Manchester City Council's internal auditors have rated the retention of images of residents' bank cards on a shared Microsoft Teams channel a critical and avoidable data security risk, in a limited assurance report on payments to individuals by children's social care teams.

The audit, led by Tom Powell, the council's Assistant Director (Assurance and Risk), examined cash, voucher, PayPoint and purchase card payments made to families through the council's three district offices.

It found that images used to verify residents' bank details were being stored on the Business Support Faster Payments Teams channel and in team folders and emails, to which all social workers in the relevant locality, business support staff and the relevant finance officers had access.

The report's first critical recommendation is to cease the practice of using and storing the images in team folders and emails as evidence to support residents' bank details, with a three-month deadline. Auditors said they raised the concern with the Business Support Lead early in the fieldwork and supported a meeting to identify alternative methods of verifying bank details.

The service subsequently confirmed that the images were no longer accepted and had been removed. A follow-up check by auditors nevertheless identified several instances where images were still being stored across both the Central and North teams' records, which the report described as an ongoing data security risk.

The council said the issue had been identified and management action taken, although a small number of records remained to be removed at the time of audit. "These have all since been removed and there is no evidence that the information was accessed beyond its legitimate use by the team who were collating and retaining it," a council statement said. The council said there had been no security breach.

Liberal Democrat councillor Richard Kilpatrick, a member of the Audit Committee, called for the matter to be referred to the Information Commissioner's Office. "I'm concerned there's a culture of not referring when they know that they've done something wrong, even though it is absolutely in the interest of the council once a mistake has been made to accept it made a cock-up and investigate it properly," Kilpatrick said.

Under UK GDPR, a personal data breach is defined in Article 4(12) as a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. Whether retention of card images on a channel open to a wide staff group meets that definition does not turn on evidence that anyone misused the data.

Article 32 requires controllers to implement technical and organisational measures appropriate to the risk, including limiting access to those who need it, and Article 5(1)(c) and (e) require that data be adequate, relevant and limited to what is necessary and kept no longer than necessary.

Article 33 requires notification to the ICO within 72 hours of becoming aware of a breach unless it is unlikely to result in a risk to individuals. Payment card images are also within scope of the Payment Card Industry Data Security Standard, which prohibits storage of card data beyond what is strictly required.

The version of the report now on the council's website is a redacted replacement. The original Appendix 2 to the Internal Audit Assurance Update was published in sequence with the rest of the committee papers but has been withdrawn behind a login, and the live document carries a note stating that Executive Summary I has information redacted "that if published could increase the Council's exposure to crime, as it exposes weakness in control that could be targeted by criminals".

Every reference to the nature of the images is blacked out, including in the critical recommendation and the conclusion. The names of four suppliers have also been removed on the grounds that publication could affect commercial relationships. The covering report to the committee summarises the Payments to Individuals audit without mentioning the card images.

Children's Services is developing an electronic Financial Authorisation Form within Liquid Logic to record approvals for all payments, which auditors said should address several of the risks identified, the council said.