Welsh environmental regulator exposes diversity data of 2,000 staff in FoI blunder
Sensitive employee information was inadvertently published online for years before discovery.
1The breach details
Natural Resources Wales (NRW) disclosed diversity data of approximately 2,000 current and former employees in a Freedom of Information Act response error. The sensitive information, including ethnicity, disability status, religion, sexual orientation, and other equality monitoring details, was accidentally published online. While not all categories applied to every individual, this constituted special category personal data under UK GDPR. The breach affected employees who worked at NRW between April 2013 and March 2018.
2What data was exposed
The exposed spreadsheet contained highly sensitive personal information about NRW staff members. This included protected characteristics like religion or belief, sexual orientation, and Welsh language ability. Additionally, it revealed personal circumstances such as caring responsibilities. While the exact combination varied per individual, all this data falls under special category protections in UK data protection laws. The breach potentially exposed employees to discrimination risks if the information was misused.
3Timeline of events
The data was initially released in 2021 as part of an FoI response but remained publicly accessible until August 2026 when discovered. NRW became aware only after a member of the public alerted them on August 23, 2026. This means the sensitive information was potentially available for five years before detection. The organization immediately removed the data upon discovery and confirmed its permanent deletion. However, the prolonged exposure period significantly increased potential risks.
4Regulatory response
NRW reported the incident to the UK Information Commissioner's Office (ICO), which oversees data protection compliance. The organization launched a full investigation into how this sensitive data was published and remained online undetected for years. NRW stated it's reviewing all processes and controls to prevent recurrence. While no evidence of misuse exists, the extended exposure period complicates risk assessment. The ICO may impose penalties depending on investigation findings.
5Organizational impact
This breach severely impacts NRW's reputation as an environmental regulator handling sensitive data. The prolonged undetected exposure suggests systemic failures in data governance. Employees affected may lose trust in the organization's ability to protect their information. NRW faces potential legal consequences under GDPR, including possible fines up to 4% of annual turnover. The incident also raises questions about NRW's compliance culture and oversight mechanisms.
6Employee concerns
NRW acknowledged the breach may cause significant concern among affected individuals. The organization advised staff to remain vigilant for unexpected communications that might indicate misuse of their data. While offering apologies, NRW provided no specific compensation or support measures beyond general warnings. Employees now face uncertainty about whether their sensitive personal information was accessed during the five-year exposure window.
7Process failures
The incident reveals multiple breakdowns in NRW's data handling procedures. First, the initial inappropriate release in an FoI response indicates poor vetting processes. Second, the five-year gap before detection shows inadequate monitoring of published information. Third, the breadth of sensitive data included suggests insufficient data minimization practices. These cumulative failures point to systemic weaknesses in NRW's information governance framework.
8Broader implications
This case highlights critical lessons for all organizations handling sensitive employee data. It demonstrates how FoI processes can become data breach vectors without proper safeguards. The five-year detection lag shows the importance of proactive data monitoring systems. Public sector entities particularly must balance transparency requirements with data protection obligations. This incident may prompt wider reviews of FoI handling practices across UK government bodies.