Salary details of 15,000 council staff published online in error

South Lanarkshire Council HQ

Union bosses say they will support legal action over the data breach

A data breach at a Scottish council has led to the personal details of around 15,000 council employees published online in error.

The GMB union said it will back any members at South Lanarkshire Council taking action if they suffered any financial loss as a result of the breach.

The council has confirmed a spreadsheet containing information about job titles, salaries and national insurance numbers was included in a freedom of information request about staff pay grades.

The local authority said it was a “human error” that the spreadsheet contained data that had not been anonymised.

This was spotted by the council, which said it arranged for the data to be removed.

But the data was available on the popular freedom of information website What Do They Know for around a month.

The breach also affects ex-employees as it included the data of those who worked for the local authority prior to 2021.

One employee said: “This is an absolute disgrace.

“They've leaked everything and left us completely open to the threat of identity theft.

“We're always under the cosh and being threatened with the sack if you make a mistake – well the person responsible for this is now under the cosh. Heads should roll.”

Staff were told about the breach via an internal email from the admin team of the finance and corporate resources department.

It read: “I need to inform you that a spreadsheet containing anonymised council employee data was uploaded to a website in response to a Freedom of Information request.

“Unfortunately, as a result of human error, the spreadsheet contained a second page of personal data that had not been anonymised.

“The error was noticed by the council and we arranged for that data to be removed.

“This included your data, including your name, job description, line manager name, place of work, salary details and National Insurance number.

“I must apologise that this has occurred.”

GMB organiser Ude Adigwe said staff were right to be concerned and deserve more than assurances that such an error will not happen again.

He said: “This is a very concerning incident and poses serious questions about the council’s data management processes.

“Staff deserve more than a simply assurance from the council that policies and procedures have been tightened.

“They deserve an investigation, the fullest possible explanation of how this happened and to be told exactly what measures are being taken to stop it happening again.”

A spokesperson for South Lanarkshire Council said: “A spreadsheet containing anonymised employee data was uploaded to a website in response to a freedom of information request.

“Unfortunately as a result of human error, the spreadsheet contained a second page of personal data that had not been anonymised. The error was noticed by the council and we arranged for that data to be removed.

“To the best of our knowledge the information was not accessed, and we believe the data could not be used in a way that would be harmful to those involved.

“However, I can confirm that we are contacting those affected by the error and we have reported the breach to the Information Commissioner.”