Royal Cornwall Hospitals NHS Trust has confirmed a data breach involving the personal information of thousands of current and former employees, after an internal spreadsheet was accidentally published online.
The trust has written to around 8,100 staff members whose details were affected. The incident occurred when an editable spreadsheet was inadvertently disclosed as part of a Freedom of Information (FOI) request and uploaded to the trust’s disclosure log.
What information was exposed?
According to the trust, the spreadsheet contained:
- Staff names
- Job titles
- Descriptions of sickness absences
- Dates of those absences
According to Cornwall Live, a letter sent to affected staff confirmed that the breach went beyond sickness absence data. In addition to absence records, the disclosure included full names, job roles, departments, and staff grades and pay bands. While no individual salary figures were shared, pay band information is publicly available, meaning approximate salary ranges could be inferred.
The data relates to staff who worked for the trust between April 2020 and May 2023. The trust has said that no financial, bank details national insurance number, address of contact information, or patient data was involved.
How did the breach happen?
The trust said the spreadsheet was shared in response to an FOI request and was published in a format that allowed it to be edited and viewed in full. Once the issue was identified, the document was removed from the disclosure log, and the log itself was temporarily suspended while a review took place.
Royal Cornwall Hospitals NHS Trust has apologised to affected staff and said it took immediate steps to contain the incident.
The trust has confirmed that:
- The breach has been reported to the Information Commissioner’s Office
- New processes have been introduced to ensure spreadsheets are disabled before FOI disclosures
- Additional checks are being put in place to reduce the risk of similar incidents
An ICO spokesperson said the regulator had assessed the information provided by the trust and, after offering data protection advice, concluded that no further regulatory action was required at this stage.
FOI-related breaches are a recurring issue across public bodies. Even where disclosure is unintentional and patient data is not involved, publishing identifiable staff information can still have real personal and professional consequences.
We are continuing to monitor developments in this case and will let you know if a group action is launched by one of our trusted legal partners.
