Authority breached Data Protection Act by making planning application with sensitive data available online
The Information Commissioner’s Office (ICO) has fined Basildon Borough Council £150,000 for accidentally publishing sensitive personal information about a family.
It has ruled that the council breached the Data Protection Act when it made information in planning application documents publicly available online.
The ICO’s investigation found that in July 2015, the council received a written statement in support of a householder’s planning application for proposed works in a green belt.
This contained sensitive personal data relating to a static traveller family who had been living on the site for many years. In particular, it referred to the family’s disability requirements, including mental health issues, the names of all the family members, their ages and the location of their home.
Basildon published the statement in full, without redacting the personal data, on its online planning portal later that day.
Failing procedures
The ICO investigation found that this was due to failings in data protection procedures and training. An inexperienced council officer did not notice the personal information in the statement, and there was no procedure in place for a second person to check it before the personal data was inadvertently published online.
It took several weeks, until 4 September 2015, for the details to be removed after the concerns came to light.
ICO enforcement manager Sally Anne Poole said: “This was a serious incident in which highly sensitive personal data, including medical information, was made publicly available. Planning applications in themselves can be controversial and emotive, so to include such sensitive information and leave it out there for all to see for several weeks is simply unacceptable.”
Even though the council had been routinely redacting personal data from planning documents - a practice also widely adopted by other local authorities - Basildon argued it was not, in fact, allowed to do so under planning law.
The ICO rejected the argument, stating that planning regulations could not override people’s fundamental privacy and data protection rights. It added that publication of planning documents online was a choice, not a legal requirement.
Poole added: “Data protection law is clear and planning regulations don’t remove an individual’s rights.”
Image: http://eng-cs.syr.edu/research/cybersecurity
