Stratford-on-Avon District Council disclosed in February 2024 that a member of its staff had copied around 79,000 resident email addresses from a council database and used them to promote a business unrelated to the authority.
The council said the data was taken in November 2023 from a database of email addresses supplied by residents for its garden waste collection service. A follow-up investigation found the same person had also taken email addresses belonging to Warwick District Council residents, which Stratford-on-Avon held under a joint working arrangement between the two authorities.
Both councils said the databases contained email addresses only, with no names, postal addresses or bank details attached. The individual was no longer employed by the council by the time the breach was made public, had apologised, and confirmed that all of the copied addresses had been deleted.
Warwickshire Police investigated and issued the former employee with a caution for knowingly or recklessly obtaining or disclosing personal data without the consent of the data controller, an offence under the Data Protection Act 2018. Both councils reported the incident to the Information Commissioner's Office, which confirmed it would take no further action against either authority. Council leaders characterised the incident as a deliberate act by one individual rather than a failure of the councils' systems.