Statement

We’d first of all like to apologise to those people who have mistakenly received this information and can confirm we are investigating this matter to make sure it cannot happen again.

We would like to reassure residents that the information contained in these emails is all publicly available in the borough’s electoral register, which is an open document that can be inspected by any member of the public at any time during the year. The emails did not contain any other information beyond what is already in the public domain.

We are seeking advice from the relevant data authorities and will of course act on any further guidance they provide.

Frequently asked questions

Q – How has this happened and what are you doing about it?

A - There have been a number of electoral ward boundary changes introduced recently and because of this the Council’s Electoral Services team were contacting the electorate to confirm their polling station. Regrettably, due to human error, your name and address was incorrectly emailed to one other person.

Those affected were immediately notified that an error had occurred and later that evening an apology and the correct information was sent. The Council’s Data Protection Officer (DPO) was also notified. They have conducted an initial investigation to understand how this occurred and provided advice to Electoral Services. They have also informed the Information Commissioner's Office (ICO).

Q – How is my data held on the electoral register, and who can access it?

A – There are two versions of the electoral register, the full register and the open register. Each elector’s name and address is entered on the full version of the electoral register, and you cannot opt out. This is the version of the register that’s used for elections and referendums.

The open register, also called the edited register, it contains the same information as the full register but is not used for elections or referendums. Voters can opt to have their data removed from the open register which is available for general sale to interested parties.

Q – Has my data been sent to one or more individuals, can you tell me who it was sent to, even if I submit a Subject Access Request (SAR)?

A – The personal details included in these emails were the elector’s name and address only (no email addresses or dates of birth were disclosed). The email was incorrectly sent to one other person only. Where information was incorrectly received the recipients have been asked to delete this information. Regrettably we are restricted by the Data Protection Act and therefore cannot confirm to you who your name and address was sent to.

Q – Has this breach been notified to the Information Commissioner?

A – The ICO is an independent body responsible for the oversight of Data Protection and General Data Protection Regulation (GDPR) compliance. The DPO has been in contact with the ICO and explained how the breach occurred and the information incorrectly shared. The ICO has confirmed verbally the initial actions taken to minimise any risk of harm or disruption to individuals as appropriate. They also confirmed that the likelihood of any harm or disruption is minimal as the data shared was restricted to just name and address and disclosed to one other person only.

Q – Am I at risk of fraud?

A – As the information shared was restricted to name and address only and was only shared with one other individual the risk of fraud is extremely low.

The limited information that has been shared (name and address) is insufficient on its own for criminals to steal or create false identities. An individual’s name and address data are included on the full register which is available for public inspection under supervision.

Q – How do I know this won’t happen again?

A – The Council has investigated how the incident occurred and is looking at lessons that can be learnt to minimise the chance of any reoccurrence. The Council will review its practice and processes around the use of this data.

Q – I’m still not satisfied, what do I do next?

A – If you have any further queries about the electoral register or about your entry on the register, please contact Electoral Services (electoral@wandsworth.gov.uk)

If you wish to make a complaint about this matter, please contact the Council’s Data Protection Officer (dpo@richmondandwandsworth.gov.uk).

You also have the right to raise concerns directly with the Information Commissioners Office (ICO).