Natural Resources Wales (NRW), the Welsh government’s principal environmental regulator, has confirmed a significant data security lapse involving the personal information of approximately 2,000 current and former staff members. The breach, which stems from a procedural error in handling a Freedom of Information (FoI) request, resulted in sensitive diversity and equality monitoring data being exposed online for several years.
The organization disclosed that the incident occurred in 2021 when a spreadsheet containing staff data—covering the period between April 2013 and March 2018—was inadvertently published on a third-party website. The breach remained undiscovered until recently, raising questions regarding the adequacy of internal oversight and data governance protocols at the public body.
The exposed dataset included highly personal information, often categorized as “special category data” under the UK General Data Protection Regulation (GDPR). According to NRW, the information potentially accessed included details regarding employees’ ethnicity, disability status, religious beliefs, sexual orientation, caring responsibilities, and proficiency in the Welsh language. While the organization noted that not every data category applied to every affected individual, the exposure of such sensitive personal identifiers represents a serious failure in data protection management.
In a formal statement issued on Friday, the environmental body expressed “sincere apologies” to the affected individuals, acknowledging the “concern and uncertainty” the discovery would undoubtedly cause. The regulator stated that upon discovering the oversight, it took immediate action to contain the breach. This included liaising with the host of the website to remove the file and securing confirmation that the data had been permanently deleted from the site’s servers.
NRW has also reported the incident to the Information Commissioner’s Office (ICO), the UK’s independent authority set up to uphold information rights in the public interest. While the regulator is currently conducting a full investigation into how the spreadsheet was mishandled and why it remained unnoticed for years, it has sought to reassure those affected by stating that there is currently no evidence of misuse of the data.
“While we are not aware of any evidence that the information has been misused, we encourage individuals to remain vigilant for any unexpected communications and to report any concerns,” the organization advised in its disclosure statement. “We are continuing to review our processes and controls to help prevent a recurrence.”
The incident highlights the inherent risks associated with processing FoI requests, particularly when dealing with large, complex datasets. Public bodies are often tasked with balancing transparency requirements with the stringent protections afforded to personal privacy. Critics and privacy advocates argue that the five-year duration between the initial disclosure and the discovery of the breach suggests a fundamental lack of robust auditing processes for outgoing data, particularly when that data is being shared in response to external information requests.
As the investigation continues, the focus will likely shift to how the error occurred—whether through a technical oversight or a failure in the internal vetting process for released documentation—and what systemic changes NRW must implement to restore confidence among its workforce. For the 2,000 affected employees, the regulator’s promise of ongoing vigilance and policy review comes as a necessary, if delayed, step toward rectifying a significant breach of trust.
Disclaimer: This content is auto-generated for informational purposes only.
Source: Read Original News
