Data watchdog fines Brit council £120k for identifying 943 owners of vacant property

Accidentally pulled cloth off pivot table in Grenfell Tower FoI

A London borough has been slapped with a £120,000 fine from the data protection watchdog after unlawfully identifying 943 owners of vacant property in a Freedom of Information (FoI) response.

The Information Commissioner fined the Royal Borough of Kensington and Chelsea for breaching the Data Protection Act, after it accidentally divulged the information in a request related to the aftermath of the Grenfell Tower fire tragedy. At least 70 people died when Grenfell Tower – a 27-storey public housing block in the wealthy London suburb of North Kensington – caught fire in June 2017.

After the incident, some media outlets provided social commentary on the inequality between owners in the borough who could afford to leave their properties empty, and the residents of the public housing complex who lived in relative poverty.

On 30 June 2017, the council received three separate requests for information on the number of vacant properties from journalists with links to a national daily newspaper.

In responding to the request, the council forgot to remove the underlying pivot table which included a list of named owners against the addresses of empty properties in the borough.

A member of the FoI team failed to pick up on the hidden data, only scrolling over the spreadsheet and clicking once, whereas double-clicking on any cell would have revealed the identities of the owners of the empty properties.

On 1 August 2017, the number of empty properties in the borough – 1,652 – was published on a national newspaper website, together with the names of three high-profile owners.

The ICO noted the council reported the incident to Information Commissioner Elizabeth Denham and was cooperative during her investigation. It also took prompt action to ensure the journalists deleted the spreadsheet and the subjects were informed of the data breach.

However, it found the council had failed to take appropriate measures against the unauthorised processing of personal data in contravention of the seventh data protection principle.

A Kensington and Chelsea Council spokesperson said: "It was an error and we apologise. We accept the fine, and we have reviewed our processes to prevent this happening again."

The council has been heavily criticised for its handling of the fatal Grenfell Tower fire incident, and has since promised to spend £220m to build and repair affordable housing. ®