Watchdog faces probe over data gaffe

Scotland in Union was set up after the 2014 independence referendum

The UK's election watchdog has apologised after mistakenly releasing details of donors to a pro-Union campaign group.

The Electoral Commission tried to redact details of 168 individuals who had donated to Scotland in Union, after a Freedom of Information request.

But a "technical issue" meant the full names could be seen simply by cutting and pasting the spreadsheet.

The body now faces investigation by the Information Commissioner's Office.

Set up after the 2014 independence referendum, Scotland in Union describes itself as a "non-party organisation campaigning to promote Scotland in the UK ". It is currently led by former Labour MP Pamela Nash.

The group's website promises supporters it will protect "your privacy and processing your personal information in accordance with the Data Protection Act 1998 (updated in 2017) and to protect personal information once we have received".

The group responded to a request from the Electoral Commission to supply a list of donors who had provided £500 or more.

The group says it promotes Scotland in the UK

It said the information was encrypted to protect its supporters' right to privacy.

The commission then published the list in redacted form without names on its website on Wednesday.

But it was soon discovered the names could be read simply by cutting and pasting the spreadsheet into another document to remove the blanked out details.

The National newspaper said the list included friends of Prince William, aristocrats and leading business figures who collectively donated about £650,000.

The information was also circulated widely on social media.

A spokesman for Scotland in Union said: "It was encrypted when we sent it, so we were pretty surprised that the information had not been redacted."

The group claimed some of its supporters had already faced harassment as a result of the error.

The spokesman added: "We have still to receive a full explanation from the Electoral Commission as to why they placed private information about our supporters in the public domain and we are consulting our legal team about next steps.

"Unfortunately, we have already had instances of supporters being harassed as a result of the Electoral Commission's breach. This is completely unacceptable."

'Technical issue'

In a statement, the Electoral Commission said: "On 25 April the commission was notified of a technical issue with the application of redactions in a Freedom of Information response published on the commission's website.

"The redaction was ineffective and enabled access to personal information in relation to donations to Scotland in Union.

"The commission takes the management of data extremely seriously and regrets this issue.

"We are taking all reasonable action to minimise any harm caused and to rectify matters where we can."

The statement added: "We immediately removed the response from our website and are working with Scotland in Union to ensure that the individuals affected are notified.

"The Information Commissioner's Office has been formally notified of the breach. We are carrying out a full test of our redaction tool to understand how it occurred and will subsequently update internal procedures if required."

The release of such information may be in violation of the Data Protection Act 1998 and could result in criminal prosecution or a penalty of up to £500,000.

A spokesman for the Information Commissioner's Office said: "We are aware of a potential data breach in relation to the Electoral Commission and are making inquiries."