Sometime around the 13 March a list of leaseholder addresses with names were discovered on the planning portal as part of the Crescent House planing application (26/00106/FULL), in breach of data protection laws.
On 14 March GLERA wrote on behalf of affected residents, and on 2 April the Comptroller & City Solicitor responded in detail, acknowledging that the publishing on line of those details has resulted in a data breach in relation to the first, third and sixth data protection principles:
- Lawful, fair and transparent
- Adequacy
- Security
Read the letter in for full details:
Below a section from the letter which covers an apology, action taken, advice for residents including how to make a complaint:
2 APRIL
….In summary of the matters raised, we would like to offer our sincere apologies for the breach that has occurred and note that the error occurred as a result of human error and note that we uphold your complaint.
Following notification of this incident, the document containing the Schedule of Owners has been taken down from our website, and the Schedule of Owners has been permanently removed from publication on our website and we can confirm that there is no intention to republish the Schedule of Owners.
In addition, following the incident being raised, further guidance has been provided to the team responsible for this personal data, as to the importance of checking documents to ensure that only the relevant documents are published. The City of London will also be undertaking a review of the procedures which lead to the publication of planning documents, to prevent this from occurring again, and further guidance notes will be provided to the team in addition to the matter being raised at the next team meeting.
Should any resident have further questions concerning this instance we recommend that they are asked to contact the Compliance Team: information.officer@cityoflondon.gov.uk, and we will review the matters raised.
Lastly, we note that as the names and postal addresses were included on the webpage, it may be possible that the personal data was captured as part of key terms that are captured and used by Google to create search results (known as a Google Cache). A good way to check this is for the resident to undertake a search of their name and see if any results come up which link them to the Schedule of Owners.
Any impacted residents are recommended to contact Google directly and request the removal of their personal data from any search engines and we note that the following link provides helpful information as to how to remove the personal data from the search results.
How to Remove Personal Information from Google Search: Step-by-Step Guide – Google Search Community
We hope this response is helpful in explaining to you the City of London’s Corporation’s position with regard to the issues that you have raised and would like to thank you for raising these matters with us.
If you wish to make a complaint about the way the City Corporation has handled your concerns, please make your complaint in writing to the Compliance Team, Comptroller and City Solicitor’s Department, City of London, PO Box 270, Guildhall, London EC2P 2EJ (or email information.officer@cityoflondon.gov.uk).
Alternatively, you may wish to contact the Information Commissioner for issues relating to the Freedom of Information Act 2000 and the Data Protection Act 2018. The Information Commissioner is a Crown appointment, responsible for monitoring compliance with the DPA. Please contact: Information Commissioner, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Telephone: 0303 123 1113. The website for his office is at: http://www.ico.org.uk/
Yours sincerely,
Comptroller & City Solicitor
Deputy Chief Executive
GLERA email pointing out data breach
SATURDAY 14 MARCH
To: Executive Director Environment, Executive Director Community and Children’s Services, the Comptroller and City Solicitor
Cc: Chair Planning and Transportation Committee, Chair Community and Children’s services,
I am writing on behalf of leaseholders of Crescent House, Golden Lane Estate, who are upset to find a serious breach of their privacy in the displaying of their names and addresses on the City of London Planning Portal in reference to planning application 26/00106/FULL. Residents who object can expect to have their details listed but not every leaseholder.
Can I request that it is urgently taken down and an investigation launched into how this has been allowed to happen under your GDPR responsibilities.
Please forward to the City of London Data Protection Officer, I am unable to find their email address.
Kind regards
Sue Pearson
GLERA Chair 2024/26
