Council issues apology after data breach - as Derbyshire mum can't sleep after child's personal details leaked

Kim Ashton, from Buxton, said she has been left unable to sleep after Derbyshire County Council sent the email which was a response to her complaint about the delays with her daughter’s EHCP.

The email included the child’s full name, address, details of her special needs plan and her mental well-being history.

Kim said: “I just couldn't believe that they'd be so careless with the data, especially when it comes to a vulnerable child. I can’t believe they would just share her personal information with a complete stranger. I haven't slept all weekend because it's been on my mind.

"Someone who has received the email knows my child’s adress, knows personal details about her health, knows when she is at home and when she is at school.”

Kim has only found out about the breach after the council emailed her on Friday, March 1, to let her know about the incident.

She said: “I've emailed them and asked them if they could at least tell me who they sent the email to and I've just had no response at all. There's no phone number to call the special needs department at the council so you can’t even get in touch with them. You just send emails and sometimes you can wait two weeks for a response.

"I haven’t had any response so far. It is a serious data breach and no one's bothered to ring me back to help to put my mind at rest.”

Kim added: “I would like this to be investigated thoroughly by the council and some sort of disciplinary action should take place. It's confidential information that's been shared with someone else and it shouldn't have been. I really want them to learn from it and not do it again to any child.”

The Derbyshire Times contacted Derbyshire County Council following the incident.

A spokesperson for the council said: “On 28 February we were made aware we’d sent an email to the wrong person, resulting in the unintended sharing of personal data.

“We take our information handling responsibilities very seriously and asked the unintended recipient to delete the email, which they did, and advised the family who should have received the email what had happened.

“We recorded the incident internally as a data breach and reported it to the council’s data protection officer who has reported it to the Information Commissioner’s Office (ICO).

“We are waiting for a formal response from the ICO and are currently working to establish exactly what went wrong in this case to ensure steps are put in place to help prevent this happening again.

“We take any potential data breaches very seriously and are committed to handling data with the utmost care. All employees are required to undertake annual information governance training to ensure that they are fully aware of the importance of treating personal data appropriately and in accordance with our data protection obligations.”