In a letter to the CEO of Lydney Town Council, Zac said:
Firstly, I would like to thank you for the removal of the press pack published on your website on Thursday 21 February 2019 containing confidential and personal data as a result of my letter to yourself earlier today.
Unfortunately, the swift removal of such is not able to overwrite the fact
that the breach in data protection legislation under the General Data Protection Regulation 2018 (GDPR) and the Data Protection Act 2018 (DPA) has occurred and copies of the data in question have been retained for the purposes of an official complaint to the Information Commissioner’s
Office (ICO) if this is deemed necessary.
It is also unfortunate that this is not an isolated event with Lydney Town Council and therefore I feel an obligation to raise my concerns regarding another breach in data protection legislation that has occurred this year from your office. Once again, the Information Commissioner’s Office and the Monitoring Officer of Forest of Dean District Council have been copied into this correspondence for noting.
On Friday 18 January 2018 I submitted a Subject Access Request (SAR) under Article 15 of the General Data Protection Regulation in order to gain copies of all information held regarding myself by Lydney Town Council. I received a response with a variety of documentation signed by yourself on Monday 21 January 2018.
One piece of data provided, namely Appendix B, details an email regarding a Forest of Dean District Council press release in which I am quoted. This document also contains the full uncensored personal email addresses of all of the elected members of Lydney Town Council.
Thus, you have unlawfully disclosed the personal email addresses, to myself, of: Cllrs Bob Berryman; Carol Harris; Claire Vaughan; Derek Biddle; James Greenwood; Harry Ives; Kevin White and Roger Holmes.
If you had disclosed this information to another individual you could have potentially put the safety of these elected members at risk, fortunately for you they were disclosed to me and this is not something that I would ever contemplate.
A copy of this email is enclosed. This is a clear breach of data protection legislation and I advise that if a satisfactory response is not received to both these concerns and the concerns expressed within my previous letter earlier today with 1 calendar month, I will lodge an official complaint on
both counts with the Information Commissioner’s Office who could potentially issue a fine to Lydney Town Council of up to £500,000 or bring criminal charges in court against officers of the council responsible for the breach.
You can find guidance on your obligations under information rights legislation on the ICO’s website (www.ico.org.uk) as well as information on their regulatory powers and the action they
Please send a full response within one calendar month. If you cannot respond within that timescale, please tell me when you will be able to respond.
If there is anything you would like to discuss, please contact me via email to (email address).