Council appeals £150k fine imposed over publication of sensitive data

Basildon Council has confirmed it is to appeal the imposition by the Information Commissioner of a £150,000 monetary penalty for publishing sensitive personal information about a family in planning application documents that were made publicly available online.

Cllr Gavin Callaghan, Chairman of Policy and Resources Committee, said: "We take our responsibilities for data protection very seriously indeed. We are appealing this decision because we feel it is based on a misunderstanding of the council’s duties under planning legislation. This requires that we publish all information relating to a planning application."

The ICO imposed the fine last month after the local authority published a written statement in support of a planning application containing sensitive personal data relating to a static traveller family. This included the family’s disability requirements, including mental health issues, the names of all the family members, their ages and the location of their home.

At the time (July 2015) Basildon’s policy and established approach was that personal data (and in particular sensitive personal data) would be redacted from documents such as the statement before they were published as part of the electronic register of planning applications which the council made available through a web-based portal.

The council however published the statement in full, without redacting the personal data, on its online planning portal on 16 July.

An ICO investigation concluded that this was due to failings in data protection procedures and training. An inexperienced planning technician did not notice the personal information in the statement, and there was no procedure in place for a second person to check it before the personal data was inadvertently published online, the watchdog said.

The information was removed on 4 September 2015 when the data protection concerns came to light. 

Basildon unsuccessfully submitted to the ICO that, notwithstanding its established procedure (and the procedure adopted by other local authorities), it was not legally permissible to redact any information from the statement which the council decided to publish online.

The local authority argued that:

1. It was obliged under the Town and Country Planning (Development Management Procedure) (England) (Order) 2015 to include the full contents of any application – including unredacted planning statements of the kind at issue – as part of its local authority planning register. The council would therefore have been obliged to show the full contents of the planning application and accompanying statement to any member of the public who asked to see it.
2. It had a power, though not a duty, to make its planning register available to the public by means of a website. If it chose to do so, then it had no power to redact any details from that register.

The ICO said it did not accept those submissions, for these reasons:

• The 2015 Order could not be construed so as to oust individuals’ rights under the DPA, Directive 95/46/EC or Article 8 of the European Convention on Human Rights.
• The Commissioner acknowledged that Basildon was under a duty to make the ‘planning application’ available to members of the public. She was not persuaded that this duty encompassed ‘every single item of information’ which an individual includes in any document he or she submits in support of a planning application. The Commissioner was not persuaded that Parliament would have intended such a publication duty to be so far-reaching as to admit of no exceptions. She was therefore not persuaded that Basildon was precluded by law from redacting any information from the statement in the planning register which was available for public inspection.
• In any event, disclosure on a website was materially different to the right to inspection. “Even on Basildon’s legal analysis, it chose to make its planning register available online. That choice cannot override individuals’ rights under the DPA, Directive 95/46/EC or Article 8 ECHR." (ICO's emphasis)
• In any event, if – as Basildon contended – every single item of information submitted with a planning application should have been made publicly available on its website, this should have been made clear to applicants, so that they could make informed decisions about what personal and sensitive personal data they wished to adduce in support of their applications. “A failure to provide such information may render the resultant publication unfair, contrary to the first data protection principle. The Commissioner had not, however, considered whether that principle was breached here. This is because the publication of the sensitive personal data in the statement occurred due to a shortcoming in Basildon’s organisational measures….”

The ICO also rejected a submission by the council that because of an earlier published decision of a planning inspector relating to the same site and family, the affected individuals could have had not reasonable expectation of privacy in respect of the contents of the statement.