Council launches investigation following sensitive data breach
AN investigation has been launched into a security breach concerning the personal and highly confidential data of a group of 49 York residents.
About 80 documents containing names, phone numbers, dates of birth, National Insurance numbers and past convictions were taken while City of York Council was moving out of its offices in St Leonard’s Place.
The papers were given to The Press, which returned them to the council, and the authority has now called in police to help investigate. Security has also been stepped up at council premises which are being cleared and the Information Commissioner has been notified.
Among the documents was a housing application form completed on behalf of a convicted murderer who wanted to move to the city, as well as email correspondence about criminal convictions, the risks individuals may pose and their behaviour.
The documents also included:
• legal letters
• benefits information
• council tax demands
• a bank statement
• photocopies of a National Insurance card and passport
• reports on housing applicants, including past behaviour
A source has told The Press the documents were left in a skip outside the St Leonard’s Place offices, which the council is vacating.
The source also said the skip was left uncovered for a time in an area easily accessible by the public, and the documents were left behind when the container was taken away.
The council denied this and said all its paper records were treated confidentially and an “audit trail” was kept. It said the documents in question were not placed in a skip and said their removal was due to “malicious intent”.
Ian Floyd, the authority’s director of customer and business support services, said the council was treating all paper records as confidential. He said they were either kept securely for future use or, if not needed, disposed of “in a manner which protects the information”.
Mr Floyd said one skip outside St Leonard’s Place was a “confidential waste container” which was removed each evening and replaced the next morning. He said waste management service Yorwaste was disposing of the paperwork.
“This skip is manned or secured at all times, and no documents are left behind during the process of removal of the skip”, he said.
“It has come to our attention that we have been the victim of malicious intent with an isolated security breach.”
Affected residents had been notified and an investigation launched with police, Yorwaste and (mailing and packing firm) Yorkcraft, and the council has said staff at all sites were now being asked to be extra vigilant.
Mr Floyd said CCTV footage would be checked as part of the security probe, and said people who had “come too close to the skip area” or tried to get into the St Leonard’s Place offices, which are now closed, had been “challenged by security staff.”
The council is leaving St Leonard’s Place to move to new headquarters at West Offices in Station Rise. In total, the council is reducing its number of buildings from 17 to two.