Staff member issued with caution by police after taking 79,000 email addresses of residents

A member of staff at Stratford-on-Avon District Council took around 79,000 email addresses from its garden waste collection database with a view to promoting a business not related to the council, an investigation into the data breach has revealed.

The incident took place in November 2023 and subsequently saw Warwickshire Police – following a referral from the council – issue the individual concerned with a caution for “knowingly/recklessly obtain or disclose personal data without the consent of the controller (offence under Data Protection Act 2018).”

Stratford-on-Avon said initial investigations showed that the data breach was restricted to a database of email addresses, with no further personal data affected.

Further investigations found that the breach also extended to a database of email addresses of Warwick District Council residents held by Stratford-on-Avon as part of the joint working between the two councils.

The member of staff is no longer employed by Stratford-on-Avon.

Both councils reported the incident to the Information Commissioner’s Office. The ICO has now confirmed that no further action will be taken.

David Buckland, Chief Executive of Stratford-on-Avon District Council, said: "On behalf of the council I would like to apologise for this data breach. When the council was alerted to this, we immediately began a full investigation to understand how this happened.

"It is important to stress that this information only contained email addresses, it did not contain any bank details, or names and addresses.  We have concluded through our investigations that this data breach was a deliberate act by an individual, and not a breakdown of the robust internal controls we have in place."

Chris Elliott, Chief Executive of Warwick District Council, said: "Despite the robust procedures in place to protect resident's information, it has been very disappointing to find that an employee has acted independently for their own gain. I would like to reassure our residents that this was an isolated incident, and I am satisfied that the necessary steps have been taken and the data breach is now resolved."

Stratford-on-Avon’s Buckland said: "I would like to reassure residents that this was an isolated incident. The district council takes the protection of people's data seriously and the systems we have in place are safe."