It’s Our Legal Duty to Report a Clear Data Breach, GBC Statement Stresses

Published on: 30 Aug, 2019
Updated on: 30 Aug, 2019

Guildford Borough Council has broken its silence on the resignation of Cllr Susan Parker from its Executive over a reported email data breach. A statement today (August 30) said: “There was a clear data breach that the council had a legal duty to report to the Information Commissioner.”

The Acting Data Protection Officer wrote to Cllr Parker saying no further action was necessary at that stage and the council has now made clear the report was not a complaint nor was any individual named.

Cllr Susan Parker

The statement said there was a duty to mitigate any damage by warning the email recipient, The Guildford Dragon NEWS, of the breach. Details in the email were not published.

Dragon Editor Martin Giles said: “We are regulated by Impress and comply with the Impress Editor’s Code. We publish personal details only where legally appropriate, and necessary.”

The full statement reads: “Our residents, businesses and partners who share information with us, have an expectation that we will deal with data and information correctly. The council’s management of confidential information is a very important responsibility for all staff and councillors.

“We have to ensure that processes and data are managed properly, and we have a legal duty to report any data breaches.

“Although we do not comment on the details of any confidential review, it is important to reassure residents that we have taken the right and proper action regarding a data breach, now that some details are in the public domain.

“To avoid any misunderstanding, there was a clear data breach that the council had a legal duty to report to the Information Commissioner[‘s Office] (ICO) and mitigate within 72 hours.

“The internal advice about possible action was based upon our original reporting and mitigation of the data breach, which the ICO may choose to see differently. It is not a complaint to the ICO and mentions no individuals.

“We treat everyone the same in this sort of situation and follow the same process, according to the council’s rules and procedures. It’s important that we do this to protect everyone involved. So, as with any other ongoing confidential review, we cannot comment further on the details.”

In response to the statement Cllr Parker said: “I am grateful that Guildford Borough Council has publicly clarified that while there was a formal reference to the Information Commissioner, no individuals were mentioned.

“Guildford Borough Council has now informed me that this reference was not a complaint about me as an individual and I have not been named in the reference to the Information Commissioner. All councillors have been made aware of this.”