Data breach leads to dismissal, warning, and resignation

Richard Evans, Local Democracy Reporter

Data protection breaches in a local authority’s social services department led to a staff member being dismissed, an officer resigning, and a written warning.

Councillors met at the Conwy County Council’s Coed Pella HQ this week to discuss a Governance and Audit Committee report where questions were also asked about a tragic death involving a Llandudno bin lorry.

Detailed in a section listing “special investigations”, the report revealed a “Data Breach” had led to a disciplinary hearing in July 2025 followed by an appeal hearing in September 2025.

The outcome of those hearings are listed as “dismissal”. A second member of staff in social services attended a disciplinary hearing and was given a formal written warning following a data breach. In addition, a council officer resigned after a data breach in the same department.

The report doesn’t say whether the data breach incidents were linked or separate cases.

The detail of the dismissal is not included in the report, as the case is described as “legally privileged”.

In addition, the report revealed an investigation into an “IT security incident” in marketing and communications in April 2026.

According to the report, the breach led to a member of staff receiving a verbal warning and being ordered to complete “cyber refresher training”.

The same report references an “investigation into events surrounding” a “road traffic accident” involving the council’s environment, roads, and facilities department, with the “outcome” described as “ongoing”.

Councillors were told that a “lessons learnt report” as well as “recommendations” will be shared with relevant heads of service on conclusion but that the information was “legally privileged”.

But speaking at the meeting, Abergele councillor Paul Luckock raised questions about the investigations, which had taken 109 days to complete. Cllr Luckock suggested councillors should be briefed on the matters.

“I want to ask the question in terms of special investigations,” he said.

“In my reading of this in preparation for the meeting, I noticed we did spend a very significant number of days on investigations into data protection issues and cybersecurity. And those investigations led to dismissal, other disciplinary action, and a resignation.

“I think because we have devoted so much time to that, my own view is we need a little bit more information about whose data was being attacked, in a sense, and what are the risks going forward.

“And also, and I’m sure this is difficult for people, but we had the awful unexpected death of a woman in Llandudno, and I see that has been part of special investigations as well. But I am concerned that the learning from whatever the situation is there – and I understand again people are going to say that there is legal privilege – but my concern is that the lessons learnt report and recommendations will be shared with relevant heads of service on conclusion.

“Well, I think if there are lessons learnt and recommendations, that should also come into the democratic process.”

The council’s Head of Audit and Procurement, Sioned Evans Parry, said: “Both investigations you refer to are currently still undergoing police investigation, so they are legally privileged at the moment.

“Action plans have been drawn up for both investigations. I’ve just consulted with our legal advisors to have approval to let our strategic leadership team have access to one of them so they can look at the governance and any lessons learnt moving forward for the authority.”

Questions

Cllr Luckock then said the public would be asking questions about exactly what data protection had been breached.

“What would be a concern to residents, both with data protection and cybersecurity, it’s obviously their data, and in terms of the awful incident in Llandudno, people will also want reassurance that the risks around that sort of incident are not likely to go forward,” he said.

Ms Evans Parry responded: “As I say, it is subject to ongoing police investigations. I can provide assurance to you that the information accessed related to an individual and not to the wider population.

“The fatality, that is still subject to ongoing police and health and safety enforcement investigations, but I’m sure lessons learnt will be shared with this committee in due course.”

The committee was asked to consider and provide comment on the report.