Flintshire Council criticised after ‘shocking’ data breach sees personal details of Local Development Plan respondents made public

A consultation was recently held on Flintshire Council’s Local Development Plan (LDP), which sets out locations where up to 7,000 new homes could be built in the county over the next decade.

Hundreds of residents responded to the exercise amid concerns over whether the area’s health services and schools will be able to cope with the rise in population.

When their comments were published on the council’s website last week, it was discovered that their contact information could still be accessed, despite attempts by staff to hide such details.

It’s understood the breach has led to the private data of an unknown number of people who supported one particular housing site being used maliciously on a private Facebook page.

The authority said it acted “swiftly” once it was made aware of the problem, but a spokesperson for a local campaign group described the incident as “incredibly distressing”.

A spokesperson for the Keep Ewloe Green Group, who are fighting against proposals for development in Ewloe, said: “We are truly disgusted at the incompetence shown yet again by Flintshire County Council.

“All of our personal details, including our addresses, mobile phone numbers and even our places of work have been made publicly available for all to see.

“This is incredibly distressing, especially when dealing with an issue that is so locally sensitive.

“I truly now fear for the safety of many residents, in regard to the content of their comments on the LDP, whether in support or objection.”

The LDP process in Flintshire has been hit by a number of delays, most recently by the coronavirus crisis.

With most staff working remotely, the council decided to put the submission of the document to the Planning Inspectorate back by four months to October, with the public examination also held back until January 2021.

Its handling of the situation has also been condemned by a North Wales Member of the Senedd, (MS) who said its progress was crucial to protecting communities against speculative development.

Conservative MS Mark Isherwood said: “Flintshire Council have been dragging out this LDP for years.

“Not once but at least twice has the Welsh Government had to write to the council to formally encourage them to get on with it.

“This GDPR breach is just the latest event in a saga that is Flintshire’s LDP.

“What is shocking is that the council does not seem to appreciate how important this document is.

“Without a valid LDP in place our local communities and green spaces are up for grabs by developers – the LDP is the last stand for many people to protect areas important to the community.”

The authority has acknowledged the names and addresses of individuals who responded to the consultation could be accessed for several hours last Wednesday and said it was taking the matter seriously.

Although the personal details were hidden from public view when the document was created, it has accepted they could have been uncovered “with a conscious effort”.

A Flintshire Council spokesperson said: “The software used to protect these details was not adequate. Once the risk was known the documents were taken down. They have since been protected with different software.

“Having checked our website visitor records we can see that only a few people accessed the document in this short period.

“Once we became aware of the problem we acted swiftly to correct the document and to prevent further access to the personal data.

“As a responsible public body we take the issue of the security of personal information extremely seriously.”

They added: “We are investigating how the personal details in the document were able to be accessed.”

“The individuals whose details were included in the document will be contacted, and we are considering whether this matter needs to be reported to the Information Commissioner’s Office, with whom we maintain an a positive and trusting working relationship.”