UK watchdog hasn't received report about apparent data breach involving Stormont's Executive Office committee
The Information Commissioner’s Office (ICO) has yet to receive a report of an apparent data breach involving the publishing of email addresses and other personal information submitted as part of a Stormont consultation.
On Friday, the Northern Ireland Assembly said the information was “inadvertently” published online, after concerns were raised with officials by TUV MLA Timothy Gaston on Thursday evening.
The personal data was still available to view the following morning, but has since been taken down, with a message saying ‘this consultation is temporarily unavailable’ appearing instead.
Officials said the assembly would “comply fully” with obligations under data protection laws, and notify the ICO if appropriate.
It relates to a consultation run as part of the Executive Office (TEO) committee’s inquiry into gaps in equality legislation in Northern Ireland. It is understood it was carried out via a third party provider, but the information collated by the assembly was then published on its own website.
At the weekend an ICO spokesperson said: “We do not appear to have received an incident report on this matter at this stage.”
They said that not all breaches need to be reported to them, but organisations must, however, notify the ICO within 72 hours of becoming aware of a personal data breach, “unless it does not pose a risk to people’s rights and freedoms”.
The ICO added: “If an organisation decides that a breach doesn’t need to be reported they should keep their own record of it, and be able to explain why it wasn’t reported if necessary.”
Respondents to the TEO committee consultation were given options about whether they wanted their response published, or kept private. However, there were two options for those who wanted their views to be made public. The second – ‘publish response anonymously’ – offered to remove ‘all personal identifiers including name, organisation and email’.
On Thursday, North Antrim MLA Mr Gaston told officials that information such as age, name, email address and even in some cases their sexual orientation had been published online. He said he believed it was a serious data protection issue, and would be highlighting it to the ICO, the UK-wide watchdog for data protection.