A major data breach at Aberdeen City Council has resulted in hundreds of confidential tax forms being sent to the wrong employees.
The 947 P11D documents are for members of staff at the local authority earning more than £8,500 a year and contain sensitive information including National Insurance numbers, salaries and PAYE codes.
P11Ds are used to report benefits provided and expense payments made to employees by employers that are not put through the payroll.
The employees are also given a copy, should they need it for a self-assessment tax return.
Last night a council spokesman said the forms had been sent “in error”.
He said: “The council is aware of an error which has resulted in some P11D forms being incorrectly issued.
“Affected individuals will be notified directly and we apologise to those impacted.
“The issue is being investigated and measures put in place to ensure it cannot be repeated.“
Council audit convener Stephen Flynn said: “To learn about a data breach of this nature and scale is both incredibly serious and worrying – and those staff involved will be rightly frustrated and concerned.
“Senior council officers have advised me that staff will receive a letter this week with more detail and I have had it confirmed that the matter will be reported to the next audit, risk and scrutiny committee.
“Incidents like this do little to provide assurance and the council needs evidence that safeguards are in place to prevent any repeat in the future.”
Unite union north-east regional representative Tommy Campbell added that he was “shocked” that there had been such a “scandalous breach of data.”
The council is believed to have reported the breach to the Information Commissioner’s Office.
An Information Commissioner’s Office spokeswoman said: “It is an organisation’s responsibility to fully assess a breach – and then judge whether or not they need to report it the ICO.
“Where possible, this should be done within 72 hours.
“An organisation must report a breach unless it does not pose a risk to people’s rights and freedoms.
“That means organisations must assess the likelihood and severity of the risk, and take into account the potential negative consequences for individuals.
“These may include emotional distress, or physical or material damage, such as financial loss, identity theft and discrimination.
“Anyone who has any concerns about how their personal data has been handled can contact the ICO.”
