Pioneering freedom of information website WhatDoTheyKnow has paused its automated link from Brighton and Hove City Council after it repeatedly published private information online.
MySociety, which runs the site, also provides the software which powers the council’s own FOI website, which then automatically feeds to WhatDoTheyKnow.
It is now in talks with the council after being alerted to the issue by one of its volunteers, who discovered that as well as publishing the names of scores people making requests without their knowledge, it had also accidentally released personal details of junior employees.
The volunteer, who blogs as wilmslowfilmfanatics, also published a lengthy post outlining his concerns. She said: “Brighton and Hove have been publishing the names of FOI requesters who had asked to remain anonymous on their site, and worse, appear to have been uploading the private information of individuals who had decided to make a request to them direct via email.
“Since becoming aware of this issue I have had to redact personal information from over 130 ‘anonymous’ requests that contained personally identifiable information.”
She added: “In addition, whilst looking into this issue I came across a spreadsheet containing large amounts of personal data belonging to very junior employees of the council that had been sent in response to a request in error.
“This is far from the first time that the council had leaked information in that way. In June 2012 they released a spreadsheet containing the names, ethnicity information, SEN status and other sensitive personal information belonging to children who have been excluded from schools in the area.
“In March 2014 they released a spreadsheet containing the full names, gender, ethnicity, nationality and other case details of almost 1,400 children who had had contact with the council’s social services department since 2008.
“In April 2015 they released a spreadsheet containing the full names and addresses of hundreds of housing tenants and their children along with benefit information.”
Myfanwy Nixon, marketing and communications manager for MySociety, said: “We contacted the council on 20 July providing them with many examples that may constitute a breach of privacy and requesting that they address these process issues.
“Since the council have not yet acted to remove all the information we highlighted, and since lapses continue to be made, we are in the process of disabling the software that makes copies of the requests on FOI register and republishes them on WhatDoTheyKnow.com.
“In the meantime we are grateful to FOI Monkey, who has given up a substantial portion of their personal time to remedy the council’s failings by manually editing many requests and responses in order to protect users’ privacy.”
By Thursday, the council has amended its website to make it clear requesters’ details will be public, and has removed the personal information.
A spokesman said: “We are investigating this information breach and will take all appropriate action to minimise the possibility of it happening again. We are happy to work with organisations that help publicise the work of the council in the spirit of transparency.”
A spokesman for the Information Commissioners Office said: “Individuals who make freedom of information requests must have their details handled fairly.
“Many people who have made a request would not expect to have their name linked to published details of the request they have made. If a public authority is considering releasing this information then they must consider why publishing the requester’s name is necessary.
“While there is a need for authorities to be transparent about the freedom of information process, in most cases this would not extend to revealing names. We would be concerned if authorities were releasing people’s names simply to deter requesters.
“However, there may be some cases where the person making the request is doing so in a public capacity, for example if they’re a local MP, or in a professional capacity, for example if they’re a journalist, and so publication of their name may well be fair.
“At the very least people should be told that their details will be published and given the opportunity to explain to the council why their name should not be disclosed. If having raised it with the authority a person is not happy with the way their details have been handled then we may be able to help.”
FOIMonkey is a she, not a he. And it’s a shame the council haven’t thanked her.