Manchester City Council stored photos of bank cards to verify payment details

An internal audit report found that Manchester City Council stored images of individuals' bank cards on internal communications channels, creating what auditors called a critical, avoidable data security risk.

The practice emerged within children's social care, where staff retained the photographs to verify personal banking details for direct payments. However, the committee heard that all social workers, business support staff, and relevant finance officers could access the stored images. 

The council said no personal data breach occurred, claiming there was no evidence that anyone accessed the financial details beyond legitimate verification purposes. Authorities also confirmed that management took corrective action and that the audit findings led to the deletion of all remaining payment card records from internal platforms.

Training announcement: Freevacy provides comprehensive training for new and existing practitioners on the changes introduced by the DUA Act to the UK General Data Protection Regulation (GDPR), the Data Protection Act 2018 (DPA18), and the Privacy and Electronic Communications Regulations 2003 (PEC-Regulations). Our courses are always up to date and provide a forum for learning and discussing how to ensure your data protection processes remain compliant. Find out more.