Essex council fined £150,000 for Traveller family data breach

BASILDON Council has been fined £150,000 after it published sensitive personal information about a Traveller family online.

An investigation by the Information Commissioner's Office found that the council breached the Data Protection Act when it published planning application documents that included a written statement detailing the family's disability requirements, including mental health issues, the names of all family members, their ages and the location of their own.

The council published the statement in full, without redacting the personal data, on its online planning portal on the day it was received, 16 July 2015. The ICO said an inexperienced council officer did not notice the personal information and there was no procedure in place for a second person to check it before it was published online.

The information was not removed until 4 September 2015 when the concerns came to light.

Basildon argued that, even though it had routinely redacted personal information from planning documents in the past and the practice is widely used by other local authorities, it was not, in fact, allowed to do so under planning law.

The ICO rejected the claim, saying planning regulations do not override people's fundamental privacy and data protection rights. It added that the publication of planning documents online was a choice, not a legal requirement.

"This was a serious incident in which highly sensitive personal data, including medical information, was made publicly available. Planning applications in themselves can be controversial and emotive, so to include such sensitive information and leave it out there for all to see for several weeks is simply unacceptable," said ICO enforcement manager Sally Anne Poole.

"Data protection law is clear and planning regulations don't remove an individual's rights. Local authorities and, indeed, all organisations must be certain that their internal processes and procedures are robust and secure enough to ensure that people's sensitive personal information is protected."

A spokesman for Basildon Council said: "The council has been given 28 days in which to lodge an appeal against this decision. We are taking advice and considering our position."