TENS of thousands of south Warwickshire residents fell victim to a council data breach after a former staff member took details with the aim of promoting a non-council business.
When Stratford District Council revealed in November last year it had been subject of a data breach, initial investigations showed it was restricted to a database of email addresses which had been supplied to the council by residents with no further personal data affected.
But further investigations have since found the breach also extended to a database of email addresses of Warwick District Council residents held by SDC as part of the joint working between the two councils.
Around 79,000 email addresses from the garden waste collection database were affected.
These email addresses were taken by a member of staff with the purpose of promoting a business not related to the council.
Due to the theft of personal information, the matter was also referred to Warwickshire Police which carried out its own investigation and has issued the individual concerned with a caution for ‘knowingly/recklessly obtaining or disclosing personal data without the consent of the controller’.
The staff member is no longer employed by SDC and has apologised for their actions. Assurances have also been received from Warwickshire Police that all the information taken had been deleted.
SDC chief executive David Buckland said: “On behalf of the council I would like to apologise for this data breach.
“It is important to stress this information only contained email addresses, it did not contain any bank details, or names and addresses.
“This data breach was a deliberate act by an individual, and not a breakdown of the robust internal controls we have in place.”
WDC chief executive Chris Elliott also sought to reassure residents.
“Despite the robust procedures in place to protect residents’ information, it has been very disappointing to find that an employee has acted independently for their own gain.
“I would like to reassure our residents that this was an isolated incident, and I am satisfied that the necessary steps have been taken.”
The matter was reported by both councils to the Information Commissioner’s Office, and they have confirmed that under the circumstances they will not be taking any action against either authority.
Mr Buckland added: “I would like to reassure residents that this was an isolated incident. The district council takes the protection of people’s data seriously and the systems we have in place are safe.”
