Councils advised after Southend Council data breach

Councils across the country have been issued with advice after Southend City Council was one of a number of councils which inadvertently revealed the personal details of staff.

Southend Council referred itself to the Information Commissioner’s Office (ICO) following a data breach that occurred when the council answered a Freedom of Information Request (FOI) made in May last year.

The response posted on an FOI website revealed an Excel spreadsheet relating to personal staff details.

An ICO investigation is still ongoing but a spokesman said: “We issued an advisory notice to public authorities calling for an immediate end to the use of original source excel spreadsheets when responding publicly to FOI requests.

“This followed a number of data breaches where personal information was inadvertently included in spreadsheets that were shared as part of an FOI response.”

The spokesman added: “Public authorities should be putting robust measures in place to protect personal data when responding to information access requests, and to reassure the people they serve, and their staff, that their information is in safe hands.

“Southend Council made us aware of an incident and our enquiries are ongoing.”

A spokesman for Southend Council said FOI protocols had been strengthened.

They added: “Following the report of a potential data breach to the Information Commissioners Office at the start of November 2023, we are awaiting a formal response from them.

“Our Freedom of Information protocols have been reviewed to strengthen our approach to Information Governance.”

Following the breach Unison said it was taking legal advice, with the council bracing itself against potential compensation claims.

The breach occurred when a spreadsheet containing anonymised job role and structure data for one department was uploaded to an FOI website in response to the freedom of information request.

The council said it would have needed a degree of spreadsheet expertise to access the information.

Unison was contacted for comment.

Christine Sexton

Local Democracy Reporter