Cabinet Office fined ?500,000 over New Year honours list data breach

The Cabinet Office has been fined £500,000 by the UK's data watchdog after the postal addresses of the 2020 New Year honours recipients were disclosed online.

The Information Commissioner's Office (ICO) found officials failed to put in place "appropriate technical and organisational measures" to prevent the unauthorised disclosure of personal information in breach of data protection law.

Prominent public figures who had their home addresses published on 27 December 2019 on the gov.uk website included Elton John, the cricketer Ben Stokes, NHS England's then chief executive, Simon Stevens, the TV chef Nadiya Hussain and the former director of public prosecutions Alison Saunders. The inadvertently published list also included more than a dozen MoD employees and senior counter-terrorism officers.

In its finding, the ICO said the personal data of more than 1,000 people was available online for a period of two hours and 21 minutes and it was accessed 3,872 times. The ICO said in its ruling on Thursday that the Cabinet Office removed the web link to the file once it became aware of the error, but that it was still cached and therefore accessible online to people who had the exact webpage address.

At the time of the breach, the former work and pensions secretary Iain Duncan Smith, who was ennobled on the 2020 list and whose address was published, said it was a "complete disaster".

"The Cabinet Office's complacency and failure to mitigate the risk of a data breach meant that hundreds of people were potentially exposed to the risk of identity fraud and threats to their personal safety," said the ICO's director of investigations, Steve Eckersley.

"The fine issued today sends a message to other organisations that looking after people's information safely, as well as regularly checking that appropriate measures are in place, must be at the top of their agenda."