THREE councillors and the borough authority have been rapped by the information watchdog over an incident which caused ‘significant damage and distress.’

Three Basingstoke and Deane Borough Council members and the authority itself have been warned over the disclosure of ‘sensitive personal data’ by the Information Commissioner’s Office (ICO), but the watchdog has not opted to take enforcement action on the matter, The Gazette can reveal.

The data referred to a member of staff at the council and was disclosed in an email on December 8, 2017 sent by three opposition councillors to 62 other people.

The information itself was disclosed to the three by Basingstoke and Deane Borough Council chief executive Melbourne Barratt on October 30, 2017, ‘after obtaining verbal consent from the data subject’, the ICO’s letter to the authority, seen by The Gazette, reads.

The letter adds: “The dissemination of the sensitive personal data, particular in such distressing circumstances, is an unwarranted infringement of the data subject’s reasonable expectations.”

The Gazette has not been able to obtain versions of the letters sent to the three councillors concerned.

The ICO did praise the borough council for its subsequent action after the December 8 email.

The letter adds: “The council acted responsibly, quickly writing to the recipients and seeking to contain the information. They also asked all members to delete the email and not to distribute it or discuss the contents further, in an attempt to reduce the detriment caused to the data subject.”

It was this action which meant the authority avoided any enforcement action by the ICO, though measures were suggested to the council which mostly revolve around training.

Council spokesperson Sara Shepherd said: “This was an isolated incident involving the sharing of personal data about a council officer by three councillors, who have been written to individually by the information commissioner.

“As soon as we were aware of it, we reported the breach to the information commissioner and took swift action to manage the impact. This helped avoid enforcement action, with the Information Commissioner’s Office saying that we acted responsibly and quickly in seeking to contain the information.

“However, the commission states that this incident caused ‘serious detrimental effects for the data subject.’

"As a council, we take very seriously our responsibility for the security of personal information about the people who work for us.

“In line with the commission’s acknowledgement that the council has ‘a positive approach to data protection’, we are keen to learn lessons and tighten up procedures even further. The information commissioner suggested measures for us to action, including regular data protections training for councillors and reminding councillors and staff of their responsibilities in relation to personal data.”

The matter was referenced in a full council meeting in December by leader of the authority Councillor Clive Sanders who took aim at the three councillors, without mentioning them by name.

The minutes of this meeting record Cllr Sanders as saying: “Let us be clear. This is a very serious finding, which could have resulted in the council being fined up to £500,000 of taxpayers’ money and the members concerned even conceivably facing criminal charges; which was certainly considered by the information commissioner, at one stage.

“It was because we took immediate action - and by we, I largely mean the chief executive and the information governance officer, who I think deserve praise for the way that they handled this matter – it was because we took immediate action following the disclosure to contain the information and to reduce the detriment caused the data subject, that the information commissioner has decided not to take any formal action against the council on this occasion. However, a breach occurred.

“This was a very serious and highly regrettable occurrence, which could have had very far reaching and expensive consequences for the council and for those involved. It must not happen again and it is the responsibility of all us to ensure that it does not."