UK council fined £150k for publishing traveller family's personal data

An Essex council has been fined £150,000 for publishing highly sensitive personal data, including medical information, of a traveller family via online planning documents.

The Information Commissioner’s Office (ICO) slapped Basildon Borough Council for publishing the information in planning application documents, which it made publicly available online for nearly two months.

The council published a full statement containing sensitive personal data relating to a static traveller family who had been living on the site for many years. It referred to the family's disability requirements, including mental health issues, the names of all the family members, their ages and the location of their home.

The ICO's investigation found that on 16 July, 2015, the council received a written statement in support of a householder's planning application for proposed works in a green-belt area. The information was only removed on 4 September when the concerns came to light.

ICO enforcement manager Sally Anne Poole said: "This was a serious incident in which highly sensitive personal data, including medical information, was made publicly available. Planning applications in themselves can be controversial and emotive, so to include such sensitive information and leave it out there for all to see for several weeks is simply unacceptable."

The ICO investigation found that this was due to failings in data protection procedures and training.

Even though the council had been routinely redacting personal data from planning documents – a practice also widely adopted by other local authorities – Basildon subsequently argued it was not, in fact, allowed to do so under planning law.

That view was rejected by the ICO, which said planning regulations could not override people's fundamental privacy and data protection rights. It added that publication of planning documents online was a choice, not a legal requirement. ®