The government has apologised “to all those affected” after it accidentally published addresses of more than 1,000 New Year Honour recipients online.
The file – which included details of senior police officers and politicians – was uploaded to an official website on Friday evening and removed Saturday. The Cabinet Office told the BBC it was “looking into how this happened”.
The “accidental” exposure of the personal information is likely to be considered a significant security breach, particularly as senior police and Ministry of Defence staff were among those whose addresses were made public.
More than a dozen MoD employees and senior counter-terrorism officers who received honours had their home addresses revealed in a downloadable list, along with countless others who may believe the disclosure places them in a vulnerable situation.
Among the addresses were those of Sir Elton John and former director of public prosecutions Alison Saunders. Also on the list of 1,097 honours recipients were high-profile names such as cricketer Ben Stokes, former Conservative Party leader Iain Duncan Smith, TV cook Nadiya Hussain, and former Ofcom boss Sharon White.
The data breach was described as “farcical and inexcusable” by privacy campaign group Big Brother Watch.
The organisation’s director, Silkie Carlo, said:
It’s extremely worrying to see that the government doesn’t have a basic grip on data protection, and that people receiving some of the highest honours have been put at risk because of this. …It’s a farcical and inexcusable mistake, especially given the new Data Protection Act passed by the government last year. It clearly can’t stick by its rules.
Data rights lawyer Ravi Naik said the government could face legal action from those whose addresses were published, as well as from the ICO.
He also warned that anyone who came across the information should tell the ICO and not pass it onto others – because they themselves might face legal action.
Simon Winch, a sustainability professional from London, was among those who were able to access the sensitive information. He told the BBC:
I clicked on the link on the gov.uk website at around 11pm on Friday and the spreadsheet opened up. …At first I thought everyone on the list had given their permission to publish their personal addresses. But then I saw that some quite sensitive names were on there.
Another source told the BBC they accessed the file just after midnight on Saturday but were unable to do so by 05:00 GMT.
The Cabinet Office said the document was visible for around an hour.
Most of the entries in the spreadsheet include full addresses – including house numbers and postcodes.
A separate list, that does not appear to be involved in the breach, covers gallantry awards for police, ambulance and fire staff and military personnel.
Sources: The Guardian, BBC News