Data and securityCyber SecurityEssex local authority receives £150,000 ICO fine

Essex local authority receives £150,000 ICO fine

Basildon Borough Council found guilty of breaching Data Protection Act

A council has been fined £150,000 by the Information Commissioner’s Office (ICO) for publishing sensitive personal information about a family.

Basildon Borough Council breached the Data Protection Act when it published the information in planning application documents which it made publicly available online.

The ICO’s investigation found that on 16 July 2015, the council received a written statement in support of a householder’s planning application for proposed works in a green belt. The statement contained sensitive personal data relating to a static traveller family who had been living on the site for many years. In particular, it referred to the family’s disability requirements, including mental health issues, the names of all the family members, their ages and the location of their home.

The council published the statement in full, without redacting the personal data, on its online planning portal later that day. The ICO investigation found that this was due to failings in data protection procedures and training. An inexperienced council officer did not notice the personal information in the statement, and there was no procedure in place for a second person to check it before the personal data was inadvertently published online. The information was only removed on 4 September 2015 when the concerns came to light.

ICO Enforcement manager Sally Anne Poole said: “This was a serious incident in which highly sensitive personal data, including medical information, was made publicly available. Planning applications in themselves can be controversial and emotive, so to include such sensitive information and leave it out there for all to see for several weeks is simply unacceptable.”

Even though the council had been routinely redacting personal data from planning documents – a practice also widely adopted by other local authorities – Basildon subsequently argued it was not, in fact, allowed to do so under planning law.

That view was rejected by the ICO, which said planning regulations could not override people’s fundamental privacy and data protection rights. It added that publication of planning documents online was a choice, not a legal requirement.

Poole added: “Data protection law is clear and planning regulations don’t remove an individual’s rights. Local authorities and, indeed, all organisations must be certain that their internal processes and procedures are robust and secure enough to ensure that people’s sensitive personal information is protected.”

Related Articles

Housing associations collaborate around cyber awareness

Cyber Security Housing associations collaborate around cyber awareness

45m Austin Clark
Six top security and risk management trends revealed

Cyber Security Six top security and risk management trends revealed

1w Austin Clark
DDoS Defence Demands a Hybrid Approach

Cyber Security DDoS Defence Demands a Hybrid Approach

2w Guest Writer
NHS Digital joins forces with IBM to beef up NHS cyber security

Cyber Security NHS Digital joins forces with IBM to beef up NHS cyber security

2w Austin Clark
HMRC storing voice ID data 'without consent'

Cyber Security HMRC storing voice ID data 'without consent'

3w Austin Clark
Government’s rapid cloud adoption lacks security (Infographic)

Cloud Computing Government’s rapid cloud adoption lacks security (Infographic)

1m Austin Clark
Combatting the cyber security skills crisis: Retraining could help public sector digital transformation

Cyber Security Combatting the cyber security skills crisis: Retraining could help public sector digital transformation

1m Guest Writer
The need for a strategic approach to cyber security purchasing

Cyber Security The need for a strategic approach to cyber security purchasing

2m Guest Writer