Suffolk SEND campaigner Steven Wright, from near Ipswich, complains to Suffolk County Council over disclosure of his child’s ‘highly-sensitive data’

A father whose adopted child’s sensitive information was sent to another parent by Suffolk County Council (SCC) has said the local authority treats them ‘with contempt’.

Steven Wright, 54, who is a campaigner for change within SCC regarding services for children with special educational needs and/or disabilities (SEND), has officially complained to SCC over what he says is a serious breach of data protection laws in relation to his 15-year-old son.

It comes as figures in a SCC report, that went before a committee meeting yesterday, reveal there have been 588 information security incidents in 2022/23, of which 60 relate to the most serious breaches. Of all the incidents for 2022/23, 52 per cent relate to children and young people’s services.

Mr Wright, who works for a bank in IT, with part of his role making sure data is secure, said a ‘rather distressed’ parent emailed him saying they had received 80 pages of his child’s ‘highly-sensitive data’.

They told him it included an education, health and care plan (EHCP), psychology report, information on adoptive status, address and contact details – ‘just everything about my child’, he said.

Mr Wright, based in East Bergholt, south-west of Ipswich, said that parent has a tribunal hearing coming up, and his child’s confidential information had been inserted into the legal bundle.

In an email seen by SuffolkNews, SCC has apologised to Mr Wright for the incident and says it was already in the process of notifying the Information Commissioner’s Office (ICO) of this data breach.

In his reply, Mr Wright offered thanks for the email, but said: “Your apology will not be sincere since my child is only the latest victim in what appears to be a series of routine unlawful disclosures of children’s most sensitive data.

“It appears that Suffolk County Council treats the basic privacy of these children and their families with contempt and this attitude is embedded into its culture.”

Regarding the data breach in relation to his 15-year-old son, Mr Wright, who is part of the Campaign for Change (Suffolk SEND) group, told SuffolkNews: “I’m not shocked. It hasn’t happened to me before, but I hear it from other parents. I think I’m beyond being shocked.

“My child has just suffered unbelievably because of Suffolk County Council and this is just the latest thing, and it just shows the lack of care.

“I’m at tribunal (stage) and this other parent is at tribunal and the council care so little about the children as individuals that they can just get evidence totally mixed up.”

He said the response from SCC to himself and the other parent were virtually the same, adding: “I just feel like we are treated with contempt.”

The email from SCC to Mr Wright also said it had commissioned a detailed investigation into why this incident occurred and assured him the council ‘is giving the matter urgent attention’.

SCC’s information governance annual report, which features the figures on information security incidents, said the vast majority of security incidents were the result of human error. Seven security incidents in 2022/23 met the threshold for notification to the ICO.

SCC was approached for comment by SuffolkNews.

•Have you been affected by this issue? Email mariam.ghaemi@iliffepublishing.co.uk