Central Bedfordshire Council (CBC) is facing scrutiny following a second data breach involving sensitive information related to special educational needs and disabilities (SEND) in less than two months. This latest incident has prompted local authorities to consider additional training options for staff to address ongoing concerns about data protection.

Details of the Latest Incident

The most recent breach occurred when a parent erroneously received a copy of another child's education, health, and care plan (EHCP) through the post. In addition, CBC inadvertently emailed a list containing the names and dates of birth of several children with SEND to another parent. The document, titled 'Transition Children 14 plus,' detailed personal information of children aged 14 to 17, including their birthdates and the staff members assigned to their cases.

In response to both breaches, CBC issued apologies to the families affected, acknowledging the seriousness of the situation. A spokesperson for the council stated, "Unfortunately, one child’s details were sent to the wrong family in the post. Although it doesn’t meet the threshold for being reported to the Information Commissioner’s Office (ICO), we’ve made contact with those affected and retrieved the information in person."

Potential Consequences and Council's Response

Source: https://www.bedfordindependent.co.uk/second-send-data-breach-at-central-bedfordshire-council/

CBC could face significant penalties for such data breaches, although they clarified that the latest incident does not warrant reporting to the ICO. Following a previous breach, described as a “complete failure of process,” that occurred two years ago when names of dozens of SEND children were publicly posted online, the council has emphasised its commitment to safeguarding personal data. Historically, this earlier breach triggered outrage from parents and local officials alike, highlighting systemic failures in handling sensitive information.

Mark Smith, an independent councillor from Ampthill, expressed his dismay over the prior incident, saying, “The FOI request clearly stated the parent wanted statistics, not the names of these children. I find it amazing our system failed so badly; this is an appalling breach of GDPR.” In light of these incidents, CBC has reiterated its dedication to improving data protection protocols and ensuring compliance with regulations.

Moving Forward: Training and Support Measures

As part of its response, CBC is actively seeking ways to enhance staff training and implement more stringent checks and processes to prevent future errors. The council stated, “We continue to reinforce with our staff the importance of both data protection and appropriate checks and processes. We’re considering what further training, support and checks could be implemented to prevent these sorts of errors occurring in the future.”

In light of these recent breaches, the Central Bedfordshire SEND action group has also been vocal on social media, encouraging parents to report any similar incidents to the council and the ICO. The group remains vigilant, urging the council to take adequate steps to secure sensitive information effectively.

Conclusion

The unfortunate recurrence of data breaches at Central Bedfordshire Council raises pressing questions regarding the handling of sensitive information within public authorities. As CBC contemplates additional training and support for its staff, it remains essential for the council to restore trust among parents and guardians entrusting their children’s data to their care. The commitment to improved practices can pave the way toward better safeguarding of vulnerable families in the community.