SEND data breach branded ‘new low’ for Central Beds Council

A data breach by Central Bedfordshire Council has been branded "a new low" for the local authority by one of its councillors and "absolutely appalling" by another.

By Euan Duncan
Tuesday, 10th May 2022, 5:20 pm
Updated Thursday, 12th May 2022, 1:53 pm

The council's error, which is expected to result in a fine, has been revealed on social media by the Central Bedfordshire special educational needs and disabilities (SEND) action group.

It said in a Facebook post: "This afternoon we received a Freedom of Information (FOI) response from CBC which included the full names of dozens of SEND children, along with information about whether they have a school place for September 2022.

"Having alerted CBC and the Information Commissioner, we waited for the details to be taken off a public website before publishing this post.

CBC headquarters, Chicksands. Image: Google.

"The list has, of course, been deleted from our own computer and we've taken all appropriate action as advised. But having been available on a public website, it could have been downloaded by anyone.

"CBC has instigated the appropriate protocols for serious data protection breaches and asked that anyone who downloaded the document delete it immediately."

Independent Biggleswade South councillor Hayley Whitaker posted in response: "This is a truly shocking data breach, a new low for CBC."

Labour Parkside councillor Antonia Ryan was also critical of the local authority, saying: "Absolutely appalling, especially after the years of negligence CBC has shown these families."

One Bedfordshire parent posted to social media: "Nothing surprises me any more. It's not the first time, is it?

"Wasn't there something in an agenda pack about a year ago listing children on pupil premium?"

Another local SEND parent asked on social media: "Is this for real? Is there anything else they can do to keep bashing SEND families? I hope parents have been contacted to let them know.

"It sounds like the usual 'contact us' rubbish, while hoping that nobody will notice."

Independent Aspley and Woburn councillor John Baker said on social media: "Not only did this put the children at risk, but it's likely to result in a significant fine for the council."

The data protection breach happened after a parent asked CBC to provide the number of SEND children without school places for September, according to councillor Baker.

"Council officers then managed to post a list of the names of all the SEND children on a public website ... whatdotheyknow.com."

Anyone with concerns about their child’s data being available online should contact CBC's director of children's services Sarah-Jane Smedmor or chief executive Marcel Coiffait by email, according to the action group.

A council spokesman, said: "CBC takes its responsibility of looking after people’s personal data extremely seriously and our employees receive regular training around protecting personal and sensitive information.

"Regrettably we were made aware of data being accidentally released to a public website on Monday (May 9th) afternoon. But our officers worked swiftly to get the information removed.

"We're extremely sorry to all of those affected and we're in the process of contacting the families to apologise directly. We've reported the incident to the Information Commissioner’s Office (ICO) and will work positively with that independent authority.

"Changes have been made to our procedures already in response to this incident and we'll quickly act on any feedback from the ICO to make our data protection systems even more robust."