Islington Council has been landed with a £70,000 fine by the Information Commissioner’s Office (ICO) after personal details of over 2,000 residents were published online following a Microsoft Excel mishap.
Private information was published on the What Do They Know (WDTK) website, which enables individuals to submit requests for data to public authorities, after a freedom of information request relating to how housing had been allocated to local residents.
The council had failed to notice that data sent out in three spreadsheets contained private information relating to 2,375 residents who had previously submitted applications for council housing, including history of mental illness and whether they had been a victim of domestic abuse.
The information, posted on the 26 and 27 June, was available until 14 July, when a WDTK site administrator noticed the error and removed the information. The problem was reported to the ICO two days later.
According to the ICO’s investigations, the error had been highlighted to the council when the first spreadsheet was published. However two further spreadsheets were subsequently published with the same problems.
The ICO stated that problem stemmed from a ‘lack of understanding of pivot tables’ used in Microsoft Excel and other spreadsheets programs. Pivot tables are used to summarise large amounts of data, but can retain a copy of the source data used. Although this data is hidden from view, it can be easily accessed, the ICO said.
“This mistake not only placed sensitive personal information relating to residents at risk, but also the highlighted the lack of training and expertise within the council,” said ICO Head of Enforcement, Stephen Eckersley.
“Councils are trusted with sensitive personal information, and residents are right to expect it to be handled in a proper way. Unfortunately, in this case that did not happen, and Islington Council must now explain to residents how it will stop these mistakes being repeated.”
According to the ICO’s Head of Policy, Steve Wood, there is a history of problems with public bodies failing to recognise data being retained in pivot tables, and the ICO is currently investigating a number of local authorities that have encountered similar problems.