Wrexham Council Email Blunder Reveals Personal Data
Workers at Wrexham Council were left with red faces yesterday after an email blunder saw residents’ personal information being wrongly shared.
Hundreds of names and personal e-mail addresses were publicly divulged in a mail out of the authority’s annual tenant survey.
One Wrexham.com reader described the error as “the council dropping a nut” and another tweeted us saying “just checked my emails to find that wrexham council has breached data protection laws and released my email address to the public!“.
It’s believed the tenant email survey (as pictured above) was due to be sent to multiple ‘blind carbon copy’ (bcc) addresses, where each individual recipient is unaware of who else was sent a copy. However, due to human error the ‘bcc’ was just a ‘cc’ carbon copy, so everyone was able to see who was sent the email.
After the email was sent many of the recipients had another email when then council attempted to use the ‘recall’ function to get the email back. Due to the nature of email this function only works with certain software, so did not stop the email being sent.
> Subject: Recall: Wrexham Council Tenant Survey 2012
> Date: Mon, 23 Jul 2012 10:17:49 +0000
>
> XXXXXXXXXXXX would like to recall the message, “Wrexham Council Tenant Survey 2012”.
>
The Service Development Manager then got in touch will all affected people sending them an email stating:
“Dear Tenant
This morning you will have received an e-mail from the Council regarding an online survey. You may have noticed that it listed the e-mail addresses of all individuals who received the e-mail. Such information should not normally be shared as it is considered to be personal information.
The Council wishes to apologise for this error and acknowledges that personal information is strictly confidential. This was however an unfortunate mistake caused by human error. The Council wishes to assure you that it takes any potential breach of data protection extremely seriously.
As soon as the mistake was spotted all efforts were made to try and retract the e-mail, however this was not possible as the e-mail had already left the Council’s internal servers.
No other personal information aside from e-mail addresses has been shared, and we wish to re-assure you that the security of our tenants personal information is of paramount importance.
Steps have already been taken to ensure that such an incident will not occur again.
Apologies once more for any inconvenience or distress caused.”
Cllr Malcolm King, Lead Member for Finance, Performance & Governance, said: “We have acknowledged that a human error occurred which meant that personal email addresses were sent to a number of our tenants. This was an unfortunate error and we have apologised to everyone concerned. We have also taken steps to ensure this does not happen again.”
Recipients of the inital email were registered on Wrexham Council’s ‘My Council House’ system, viewable here. During the process of registration there does not appear to be an opt in, or out, of promotional emails however the page does reference the normal council website footer, which refers to Terms and Conditions, Privacy and Data Protection.
Reading the Data Protection Policy it appears that any personal information, in this example and email address, is treated as a general ‘opt in’ by default, rather than a proactive choice by an individual.
The policy overview itself is on this page, however the full text document is linked to from that page in three different formats. Section 4.2 covers marketing and states “The Council will comply with the rights of individuals under Sections 10, 11 & 12 of the Act. For example, the Council will not use personal information for marketing purposes where the person it refers to has asked the Council not to use it for such purposes.”
Mike Schirwing of the council’s Housing & Public Protection department did mention communications in the recent newsletter they send out “One of my main ambitions is to improve the way the housing service communicates with you its customers”.
While looking on the council website, we found the excellent Housing Hotline page which has current and back issues of the newsletters issued.
The latest edition also gives details of the survey, letting people know there is an iPad to be won plus a Kindle and £50 of vouchers. The links to the surveys are: surveymonkey.com/s/TenantFeedback2012 & surveymonkey.com/s/TP_Survey_Welsh_Version.
Mr Schirwing also goes as far as publishing his mobile number inviting text or voice feedback, plus his email and council address for written feedback. Such methods are preferred to the newsletter, which he says is an ‘expensive’ way of communication.
Unsolicited Emails – What Can Be Done?
As Wrexham.com is on the topic of possibly unsolicited emails we would draw our readers attention to The Privacy and Electronic Communications (EC Directive) Regulations 2003 (read it here) which covers definitions and compensation (section 30) of unsolicited commercial or promotional email sent to personal email addresses.
In simple terms if you have not consented to receiving promotional marketing email and it was sent to your personal email address ( eg. [email protected] , not [email protected]) then it is possible you have grounds to take action.
Wrexham.com is aware of several cases where compensation has been agreed, and where settlements have occurred due to ‘spam’ being sent in this manner.
Spotted something? Got a story? Email [email protected]
