Details of 34 children with special needs emailed to parent in Central Bedfordshire Council data breach

An apology has been issued to the parents of the children by the local authority – but CBC could face a significant fine for such a data breach.

The document was called ‘Transition Children 14 plus’, according to a social media post by the Central Bedfordshire SEND Action Group.

It lists children aged 14 to 17, their dates of birth and the staff member responsible for their case, said the action group.

“We know that at least two of the children are in residential settings because the parent who received it knows some of the pupils on the list.

“The latest data breach has been reported, so we hope that those affected will be contacted. Given the nature of the local authority’s email, the parent believes it could have been sent to several people.”

Responses to the action group’s online post indicate that the details have been reported to the information commissioner’s office (ICO).

The ICO upholds information rights in the public interest, promoting openness by public bodies and data privacy for individuals, explained the government website.

A council spokesman said today (Friday, July 12): “CBC takes its responsibility of looking after people’s personal data extremely seriously, and measures are taken to educate staff on protecting personal and sensitive information.

“This includes compulsory training for all staff at the local authority. Regrettably, some data was accidentally released last month.

“We’ve contacted the parents of all those affected to make them aware and to apologise for the incident.”

A previous CBC data breach was described as a “complete failure of process” when the names of dozens of children with SEND were included in a response to a parent’s question in an email two years ago.

The inquiry, asking the council to provide the number of children with SEND without school places for September 2022, led to council officers posting a list of the names on the public website whatdotheyknow.com.

Independent Ampthill councillor Mark Smith said at that time: “The council suffered a major data breach on May 9 (2022) by publishing these children’s names online potentially putting them at risk.

“The FOI request clearly stated the (parent) wanted statistics, not the names of these children. I find it amazing that our system failed so badly, to go through two sets of officers, a complete failure of process. This is an appalling breach of GDPR.”

CBC issued a full apology and said it was extremely sorry for the 2022 breach. The then council leader and now Conservative Clifton, Henlow and Langford councillor Richard Wenham said: “The council has immediately put extra checks in place.

“An internal review is in progress to look at all our procedures in this area, including the content and frequency of training for officers.

“As you’d all expect, the council will be fully supporting any investigation. CBC will quickly implement any and all recommendations coming from the ICO.”