Staff in Manchester City Council's children's services saved images of people's bank cards on internal systems and communication channels, creating a “critical” and “avoidable” data security risk, according to an internal audit report.

The report, discussed at the council's audit committee on 13 October, covered payments to individuals for children's social care, BBC News and the Local Democracy Reporting Service (LDRS) reported. The images were saved so that staff could verify people's bank details, and could be seen by all social workers for that locality, business support staff and the relevant finance officers, according to the report.

The auditors said they raised their concerns early in the audit. The business support lead later confirmed that card images were no longer accepted and had been removed, but a follow-up check still found several instances of bank card details being stored, the report said, according to the Manchester Evening News (MEN). The audit covered 15 May to 15 September 2026.

A council spokesperson said a small number of records still had to be removed at the time of the audit, and added: “These have all since been removed and there is no evidence that the information was accessed beyond its legitimate use by the team who were collating and retaining it.” The council said there had been no security breach.

The MEN reported that a council official could not confirm at the meeting whether the council had referred itself to the Information Commissioner's Office (ICO). The ICO said on 16 October that it had not received a report from the council, but explained that not all data breaches are personal data breaches and not all personal data breaches have to be reported to it.

Liberal Democrat councillor Richard Kilpatrick, who sits on the audit committee, has called for the matter to be referred to the ICO. He told the LDRS he was concerned there was “a culture of not referring” when mistakes were made.

The council said its internal audit service exists to identify areas where improvements are needed, and that it publishes substantial details of its audit work, which is discussed in public, “more than many other councils do”.

Sources: BBC News / Local Democracy Reporting Service, 20 October 2026; Manchester Evening News, 20 October 2026; Manchester City Council Audit Committee, 13 October 2026 meeting papers. This article was produced with the help of AI tools and checked by an editor against the sources above.