A Brighton and Hove City Council tenant who used to work for the council was shocked to find evidence of officials using their personal email accounts when discussing her various complaints.
Natasha Burney noticed Hotmail and similar addresses after she submitted a subject access request – a process permitting people to ask for their personal data held by organisations.
She complained to the council and the Information Commission – formerly the Information Commissioner’s Office (ICO) – back in July but did not receive a response from the council until Tuesday (20 October).
The council’s information rights lead Louise Haithwaite said: “This use of a personal email account was not in accordance with the council’s information governance requirements and forms part of the matters under investigation.
“Information obtained during the investigation indicates that the transfers appear to have been undertaken for work-related purposes.
“This remains under consideration alongside the other evidence gathered. The investigation has not identified evidence that your personal information was disclosed to unauthorised third parties.”
Investigations are continuing but she assured Miss Burney that there was “no evidence at this stage of unauthorised onward disclosure, identity fraud, financial loss or other demonstrable harm arising from the incident”.
Miss Burney, a former council employee, was concerned that her personal information had been shared after she received credit alerts for accounts set up in her name with Scottish Power, Total Money and Starlink / Space X account.
She has also received a threatening telephone call which she recorded and which has been heard by the Local Democracy Reporting Service.
In the past week a hooded visitor called at her flat and left a note stuck to her window which said: “You 2 are no longer safe.”
Miss Burney, who is chair of the Craven Vale Community Association, believes that the note applies to her neighbour who is also in dispute with the council and has had his data stolen and used to open credit cards in his name.
She said: “I am a whistleblower and I fear for my safety, that of my household and impact on the wider community.
“After making protected disclosures about serious data breaches and misconduct within Brighton and Hove City Council, I have faced intimidation, identity fraud and a physical threat left at my home.
“Internal and regulatory routes have produced no effective protection. I am therefore issuing this statement as a last resort.”
Both Miss Burney and her neighbour have raised complaints about the council’s handling of anti-social behaviour, drug dealing and cleaning. Both have received compensation after complaints to the housing ombudsman
They still have outstanding complaints with the ombudsman and the Information Commission.
In addition, Miss Burney has received compensation for misgendering by the council when she worked there.
Both Miss Burney and her neighbour are sanctioned by the council and are required to communicate with the council using a single email address.
Craven Vale Community Association secretary Alan Cooke complained to the council last year.
He said that two “highly respected (people) in the community, having helped their neighbours tackle anti-social behaviour and having worked hard to improve the area, were now being treated as persona non grata”.
The council declined to comment further, saying that cases remained open with the housing ombudsman and the Information Commission.
How many other individuals’ data was removed from the organization?
This should have been put out for everyone interacting with Brighton and hove Council. Giving us abilit to try and protect ourselves against the staff actions with the public data and it going to scammers..
There’s not been any announcement from the council for about how many other residents have been affected by these staff and what dater they took.
Heads up to anyone living in the area…
under UK data protection law (UK GDPR), Brighton & Hove City Council is legally required to inform us immediately if our personal data, housing files, or financial details are involved in a breach that puts us at risk of identity fraud or security threats.
They are completely failing to do this.
Council staff have been using unapproved personal email accounts to move confidential files off official servers. Instead of holding their hands up, warning residents, and letting people protect themselves, they’ve tried to minimizing the reality even while people are actively dealing with identity theft, fake credit accounts, and serious safety threats because of it.
If your data is held by the council, keep a very close eye on your credit reports and mail.
They have a legal duty to be transparent with us when our data is compromised, but they are hiding behind closed doors instead of doing the right thing.