Central Beds Council warned about tightening security before data breach

CBC has apologised to everyone affected after it published the names of dozens of special educational needs and disabilities (SEND) children online.

Independent councillors had warned the council a year ago that "its practices weren't up to scratch", according to their social media posts.

SEND parents and children lined up 52 pairs of shoes in a protest outside CBC's headquarters at Chicksands in September 2021, as the local authority struggled to find places for that number of SEND children.

The latest breach occurred after a parent asked the council to provide the number of SEND children without school places for this September.

Council officers then managed to post a list of the names of all the SEND children on a public website whatdotheyknow.com from where they've since been removed.

Independent Aspley and Woburn councillor, John Baker, posted on social media to say: "A year ago, I wrote to CBC after it sent a parent confidential information about their child via a public web link which would be valid for 15 days. I told the council this link should have been password protected at the very least.

"CBC has also acknowledged there was a further data breach in the first three months of this year. It's hugely frustrating for such warnings to go ignored.

"Furthermore, the local authority is becoming familiar with fines for its children's services department. I understand there have been fines of more than £12,000 during the last two years alone.

"When Independents councillors spoke to the council about the breach, we were told by its chief executive Marcel Coiffait: 'This is very concerning. I've instructed an investigation into what's happened and have also referred the incident to our data protection officer, who has a duty to report issues to the Information Commissioner's Office (ICO)'.

"Parents have also reported the data breach to the ICO," added councillor Baker. "At this stage it is not known if CBC will be fined or, if so, how much. But recent financial penalties for local authorities for data breaches have in some cases exceeded £100,000."

CBC's new director of children services Sarah-Jane Smedmor has just taken up her role with the local authority.

A council spokesman, said: "CBC takes its responsibility of looking after people’s personal data extremely seriously and our employees receive regular training around protecting personal and sensitive information.

"Regrettably we were made aware of data being accidentally released to a public website on Monday (May 9th) afternoon. But our officers worked swiftly to get the information removed.

"We're extremely sorry to all of those affected and we're in the process of contacting the families to apologise directly."

SOURCE: Central Bedfordshire SEND action group social media post, responses by SEND parents and CBC councillors, and Central Bedfordshire Council response.

What do you think about the data breach? Email: [email protected]; [email protected] or [email protected]