Hereford & Worcester

Wychavon council's National Insurance data breach probe

A Worcestershire council has revealed the National Insurance number, date of birth, signature and mobile number of someone applying for an events licence.

Wychavon District Council published the information on its website in March as part of a Temporary Event Notice.

The council said it was part of its openness policy and complied with government guidance to ensure licensing details were made public if possible.

The Information Commissioner's Office said it was investigating a complaint.

'No justification'

Wychavon District Council published the notice along with the applicant's personal details on its website on 23 March and the entire notice was taken down on 22 April.

Peter Carey, head of the examination board for the practitioner certificate in data protection and author of Data Protection a Practical Guide to UK and EU law, told the BBC that personal information should be redacted for use on a Temporary Event Notice publication.

He said: "There is no justification for making a national identity number available to the public.

"Neither should a signature be published in conjunction with name, address and contact details.

"This information can be used to secure loans, government benefits, and in further identity fraud.

"Since there is no way of replacing a National Insurance number, such theft could continue well into the future."

'Made available'

The council website states that: "For security purposes all signatures and telephone contact details will be withheld from publication on our website, this includes applicant details and any comments we have received against an application (this will not apply to comments/objections posted directly to the website)."

In a specific statement about the alleged breach, the council said: "Under the government's transparency agenda, Wychavon, like other local authorities, ensures that all licensing matters are, where possible, made available for the public."

If the council is found to be in breach of data protection it could be fined £500,000 by The Information Commissioner's Office.

Related Internet links

The BBC is not responsible for the content of external Internet sites