Northern Ireland Assembly reports apparent data breach to UK information watchdog

The Information Commissioner’s Office (ICO) is now assessing the report, first revealed by the News Letter last week. On Friday, the Assembly said the information was “inadvertently” published online, after concerns were raised with officials by TUV MLA Timothy Gaston.

It relates to a consultation run as part of the Executive Office (TEO) committee’s inquiry into gaps in equality legislation in Northern Ireland.

The gathering of information is believed to have been carried out via a third party provider on behalf of the Assembly.

However, the collated information was then published on a Stormont website, and included personal information.

Personal data was still available to view the morning after officials were alerted, but has since been taken down.

Officials had said the assembly would “comply fully” with obligations under data protection laws, and notify the ICO if appropriate.

At the weekend an ICO spokesperson said it did not appear they had received an incident report on the matter. On Tuesday, the organisation said “The Northern Ireland Assembly Commission has reported an incident and we are assessing the information provided.”

Organisations must notify the ICO within 72 hours of becoming aware of a personal data breach, unless it “does not pose a risk to people’s rights and freedoms”.

Respondents to the TEO committee consultation were given options about whether they wanted their response published, or kept private. However, there were two options for those who wanted their views to be made public. The second – ‘publish response anonymously’ – offered to remove ‘all personal identifiers including name, organisation and email’.

On Thursday, North Antrim MLA Mr Gaston told officials that information such as age, name, email address and even in some cases their sexual orientation had been published online. He said he believed it was a serious data protection issue.