A council in west London has faced criticism following the exposure of personal information affecting over 6,500 individuals, including sensitive data pertaining to children, which remained accessible online for nearly two years.

Hammersmith and Fulham Council accidentally disclosed this information while fulfilling a Freedom of Information (FoI) request in October 2021.

The local council’s response featured an Excel document comprising 35 concealed workbooks, 10 of which contained personal data, a fact that went unnoticed until November 2023.

A representative from the council stated that the mistake was rectified promptly upon notification, and staff are now prohibited from distributing information in the same manner.

The Information Commissioner’s Office (ICO) reported that the council’s response to the FoI request was added to its online disclosure log and provided to the platform What Do They Know? (WDTK), through which the request was submitted.

WDTK subsequently published the response on its website in December 2021.

The breach only came to light when WDTK conducted a review of its site, after which it alerted the council to the issue.

The exposed information was subsequently removed from both platforms.

According to the ICO, a total of 6,528 individuals were impacted, including 2,342 children.

The dataset involving adults included current and former council employees, as well as agency personnel, while the sensitive information concerning children was related to the foster care placements of those under the council’s supervision.

The ICO emphasized that children’s personal data requires “specific protection,” and highlighted particular concerns regarding the information of 96 unaccompanied asylum-seeking minors.

There is no indication that the data was accessed, used, or shared inappropriately.

The ICO acknowledged several corrective actions taken by the council, such as revisions to redaction and disclosure guidelines and the completion of training for relevant staff.