Essex council fined over personal data publishing

Basildon Borough Council has been found to have breached the Data Protection Act when publishing sensitive personal information about a family, and has been fined £150,000 by the Information Commissioner’s Office (ICO).

The ICO’s investigation found that on 16 July 2015, the council received a written statement, containing sensitive personal data relating to a static traveller family who had been living on the site for many years, in support of a householder’s planning application for proposed works in a green belt.

The council published the statement in full, without redacting the personal data, on its online planning portal later that day, with the ICO finding that this was due to failings in data protection procedures and training. The information was only removed on 4 September 2015 when the concerns were recognised.

The ICO ruled that planning regulations could not override people’s fundamental privacy and data protection rights, adding that publication of planning documents online was a choice, not a legal requirement.

Sally Anne Poole, ICO enforcement manager, said: “This was a serious incident in which highly sensitive personal data, including medical information, was made publicly available. Planning applications in themselves can be controversial and emotive, so to include such sensitive information and leave it out there for all to see for several weeks is simply unacceptable.

“Data protection law is clear and planning regulations don’t remove an individual’s rights. Local authorities and, indeed, all organisations must be certain that their internal processes and procedures are robust and secure enough to ensure that people’s sensitive personal information is protected.”