Two months after warning that many councils have 'work to do' to prepare for forthcoming EU data protection legislation, the Information Commissioner's Office has fined a local authority in Essex £150,000 for publishing sensitive information on its online planning portal.
The ICO said Basildon Borough Council did not have adequate procedures governing the redaction of statements by planning technicians.
A monetary penalty notice published last week states that an administrator in the council's business services department received a planning statement on 16 July 2015 to support a householder's application for proposed works in green belt land. The statement contained sensitive personal data about a 'static' Traveller family who lived on the site, including disability requirements and mental health issues.
The notice says Basildon's policy and established approach, in July 2015, was that personal data would be redacted from documents such as the statement before they were published as part of an electronic register of planning applications, which the council made available on the web.
The statement was given to a planning technician responsible for validating the application and checking that the personal data had been appropriately redacted. The ICO said: 'That planning technician, however, was inexperienced in checking the contents of documents relating to planning applications which contained sensitive information. He did not notice the information about the family that was embedded in the statement and therefore did not make any redactions.'
There was no procedure for a second person to check documents before they were uploaded and no guidance on what information should not be published, the ICO said. An administrator uploaded the application on to the website in July 2015; the sensitive information was removed in September.
The ICO said the contravention occurred in the context of one of Basildon's core functions as a planning authority. 'Its publication of information relating to planning applications is likely to attract attention in the local community. In that context, contraventions of this kind are likely to cause substantial damage or substantial distress because they involve public disclosure in a prominent forum,' it added.
Mitigating features included Basildon referring the incident to the commissioner and removing the relevant data. However, the commissioner said Basildon did not notify the affected individuals and did not take sufficient remedial action.
A spokesperson for the council said: 'The council has been given 28 days in which to lodge an appeal. We are taking advice and considering our position.'