Welsh environment regulator's FoI blunder exposes diversity data of 2,000 staff
Natural Resources Wales inadvertently exposed diversity data of about 2,000 current and former staff via a 2021 Freedom of Information spreadsheet published online.
Natural Resources Wales confirmed equality monitoring data of roughly 2,000 employees who worked between April 2013 and March 2018 was inadvertently disclosed in a spreadsheet released in 2021 in response to a Freedom of Information Act request. The data may have included ethnicity, disability status, religion or belief, sexual orientation, Welsh language ability, and caring responsibilities — special category data under UK GDPR. The breach was reported to the Information Commissioner's Office, the data was removed and permanently deleted, and NRW says it has found no evidence of misuse. The issue was discovered only after a member of the public alerted the regulator on 23 August 2026.
- Special category data under UK GDPR may have included ethnicity, religion, sexual orientation, and disability status.
- Breach was reported to the ICO and the exposed data was permanently deleted.
- No evidence of misuse found; exposure went unnoticed for roughly five years.
- Discovered on 23 August 2026 after a report from a member of the public.
- Vendors
- Natural Resources Wales
- Victims
- Natural Resources Wales
- Organizations
- Information Commissioner's Office
- Countries
- United Kingdom
From the original article
2 min read at theregister.comNRW says it has found no evidence data was misused after spreadsheet published in error five years ago
By Connor Jones · theregister.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.