A deputation of campaigners who had questions for Brighton and Hove City Council’s Health and Wellbeing Board were shocked when their full names and addresses were published.
The group from PSHE Brighton submitted questions and background material to the board about a National Health Service (NHS) investigation into the WellBN doctors’ surgery, in Western Road, Hove.
In papers published before the meeting, which took place on Tuesday 28 July, the council included not just the name of the speaker and five supporters but their full addresses too.
The meeting papers usually include just the names of the speaker and supporters.
After the papers were published on Friday 24 July, the group and supporters contacted senior council officers, the chief executive and leader councillor Bella Sankey and the council’s out-of-hours emergency arrangements, before the document was removed 20 hours after publication.
One of the campaigners, who asked not to be identified after receiving threats, said: “For years the council has assured residents that supporter addresses for deputations would never be published. We relied on that assurance when asking people to sign.
“This wasn’t just a technical mistake. It left women living alone feeling frightened in a city where campaigners on this issue have been subjected to intimidation.”
They were not alone in sharing their concerns, with another member of the campaign group saying that they were installing a closed-circuit television (CCTV) system at their home after receiving threats.
Another supporter, who asked not to be identified, asked the board’s chair to read out the questions and supporting material on behalf of the deputation because supporters were concerned about being identified.
In an email to the council, they said: “This is the very least you can do to do damage limitation regarding the risks your data breach has exposed him to.
“In the immediate aftermath of Ann Widdecombe’s murder, I don’t need to tell you how important privacy is as we raise political issues.”
The deputation asked whether the council had considered whether any lessons arose for its own safeguarding arrangements after the WellBN investigation.
NHS Sussex found that children as young as 11 had been treated with hormone-blockers or cross-gender hormones and were not properly told about the potentially harmful effects on their fertility.
A report said that some families had been advised to avoid contact with social services in case questions were asked about gender medication.
The investigation led to a Hove GP (general practitioner) being suspended from working as doctor.
PSHE Brighton also asked whether a review had been undertaken and if not, whether the board would commission one.
The deputation said: “This is not a request to revisit political debates. It is a request to demonstrate the principles that underpin effective safeguarding: curiosity, transparency, partnership working and organisational learning.
“Public confidence is strengthened not when institutions insist that failures happened elsewhere but when they show they are prepared to ask whether those failures reveal lessons for themselves.”
Labour councillor Paul Nann, who chairs the council’s Health and Wellbeing Board, said that the council was aware of the shortcomings found in the investigation.
But, he said, the council’s Health Overview and Scrutiny Committee was the “correct forum” at which to raise their concerns.
PSHE Brighton said: “We are disappointed that the board did not answer the two straightforward questions we asked.
“Our deputation did not seek to attribute blame to the council for the WellBN failures. It simply asked whether the council has undertaken any organisational learning for its own safeguarding arrangements.
“Public confidence is strengthened when institutions demonstrate curiosity and transparency, not by explaining why failures happened elsewhere.”
In response to the data breach, the council said: “We sincerely apologise for the mistake. We removed the document containing the petitioners’ addresses as soon as we were made aware, within 24 hours of publication.
“We immediately informed our data protection officer and notified the petitioner. Officers will also be retaking our information governance training and processes have since been updated to prevent this happening again.”
The so called “progressive” people who are so utterly convinced of their causes will stop at nothing to damage anyone who cannot be converted to their own point of view. We live in a dangerous time where the self justification to break laws is seemingly an absolute given. There is little fear of prosecution and if it does happen the penalties are often light. What were the motives for releasing these data in this instance? Why was this instance different? Is this person responsible suitable for further employment in this role ? A simple lesson will be learned speech is not good enough.
Maximum GDPR breach penalty £17.5m or jail time for the individual responsible. Well done BH City Council. Quality.
You don’t go to jail for GDPR breaches, that bit is incorrect.
This should be proactively reported to the ICO – that is clear. BHCC has an increasingly poor reputation with the ICO since 2023… numerous breaches of the FOIA… and I recall a similar instance of personal data being disclosed on FOIA responses also. Feels like an area where an independent investigation could be warranted
It would have been self reported, yes.
As one of the founders of the parents group PSHEbrighton (PSHEbrighton.org), I’m grateful to Brighton & Hove News for reporting on this. The immediate issue was serious. Six supporters of our deputation had their home addresses published online, despite the Council’s long-standing assurance that supporters’ addresses would never appear in public papers. The document remained online until Saturday afternoon, after 20 hours of repeated emails and telephone calls from those affected succeeded in alerting the sleeping Council. We appreciate the subsequent apology and note the assurance that an investigation is – apparently – under way.
However, the breach should not overshadow the purpose of the deputation itself. We asked a straightforward governance question: what lessons will our council learn following the independent NHS investigation into WellBN? If, as Councillor Nann says, the Health Overview & Scrutiny Committee (HOSC) is the appropriate forum for considering these wider safeguarding issues, and if HOSC has already indicated it will consider undertaking that scrutiny, then we very much welcome that and look forward to seeing it take place.
The WellBN scandal has shown why safeguarding cannot be viewed through organisational silos. If children in our schools have ended up in specialist clinics (and we know they have), then organisational learning depends on scrutinising this evidence base. That was the purpose of our deputation, and we hope the Council will now examine those wider questions openly and thoroughly.
In any job I’ve worked in, a GDPR breach of this magnitude would be a sackable offence as it can represent a £multimillion fine for the company.
In this case, it also appears to be politically/maliciously motivated, which can involve a prison sentence for the individual responsible under the Data Protection Act 2018 (DPA), which establishes distinct criminal offences for individuals, in addition to penalties for organisations.
There’s nothing here to suggest that it is politically or maliciously motivated.
I am one of the people whose home address was published by the Council. I appreciate that the document was eventually removed and that an apology has been given. But for almost a day my home address was publicly available online because of a mistake the Council had repeatedly assured us could not happen.
Our deputation wasn’t about politics. It asked what lessons Brighton and Hove City Council should learn from the independent WellBN investigation. I hope that question is now properly examined.
So who did this and what action have BHCC taken against them?
The article reads:
In response to the data breach, the council said: “We sincerely apologise for the mistake. We removed the document containing the petitioners’ addresses as soon as we were made aware, within 24 hours of publication.
“We immediately informed our data protection officer and notified the petitioner. Officers will also be retaking our information governance training and processes have since been updated to prevent this happening again.”