On 11th March 2025, Cheshire East Council provided its response to a Freedom of Information Request focussed on data breaches submitted by Alicia Broadest on 26th February 2025. It looks like Ellie Simcox, the Information Rights Assistant from Chester East replied to the Freedom of Information Request on behalf of the Local Authority. Mrs Broadest wanted ‘to know, amongst other things, to what extent the Council has implanted data encryption and cyber policies, losses that they have incurred and whether the council carries insurance against losses from cyber security breaches’.
The Freedom of Information Request revealed that it has received ‘212 reports of a suspected data breach during the calendar year from 1st January 2024 to New Years Eve 2024. Ellie Simcox speaking for the Local Authority sought to ‘provide some context to the number of suspected data breaches that had been reported’. They confirmed that ‘All potential data security incidents and data breaches are reported in accordance with internal policies and procedures’. She claimed ‘Staff are encouraged to report incidents as soon as they are discovered, even if they are unsure of the risk at the time. This leads to reporting of ‘near misses’ where, upon investigation, there was no unlawful disclosure’.
Chester East claimed ‘a number of data breaches reported are internal only’. They seem to think this ‘means that the information was sent to the wrong colleague’. They claim that ‘all staff are trained in data protection and the risk is markedly lower’ adding, ‘However, we (Cheshire East Council) still ask that these incidents are recorded so that the Information Governance Group has oversight of all potential security incidents to monitor patterns and respond accordingly’.
The Council also stated that ‘Cases of ‘inappropriate handling’ are also reported meaning that the Council receive reports for personal data sent by email, but not sent securely, as there is a risk of interception. These are reported even where there is no evidence of interception’.
The spokesperson for the Local Authority claimed that ‘cyber-attack incidents are reported where third parties who process our data suffer an attack and staff will report a cyber-attack even if our data has not been compromised as a result’.
Data breaches
The Local Authority revealed that it was under a legal obligation to ‘disclose or inform the Information Commissioner’s Office of two data breaches during the calendar year from 1st January 2024 and New Years Eve 2024’. The reason for the Local Authority making contact with the Information Commissioner’s Office was ‘due to unauthorised disclosure’.
In this regard the Local Authority noted in its email to me that, ‘All reported incidents are managed by our Information Governance Operational Group, who assess the risks when incidents are first reported and ensure that appropriate actions are taken to manage and mitigate the effects of the breach. They also identify measures to reduce the likelihood of similar breaches occurring in the future. Actions vary depending on the nature of the incident but may include additional training, reviewing/amending policies and procedures, and internal communications to remind staff of correct procedures and highlight risks. The monthly report provided to the Strategic Information Governance Group identifies common themes or patterns of incidents and details higher-risk incidents’.
Surely the Council has insurance?
Given how important data is and the scale of the financial penalties which could be imposed if a breach of data protection law was to take place, the main point was the answer to the question of whether Cheshire East:
- ‘has an existing cyber insurance policy in place,
- how long the Local Authority has had it? and
- whether It has any plans to invest in cyber insurance in the coming year.
In their original answer to the Freedom of Information Request Ellie Simcox speaking on behalf of the Local Authority emphatically ‘no’ to whether the Local Authority has a ‘cyber security insurance policy in position’ and as such it has ‘not had to make a claim in the past twelve months’.
The Local Authority stated that it does not currently have an insurance policy, alternatively they reduce the likelihood of a ‘legal or financial breach via a mixture of:
- staff training
- security measures; and
- a wider suite of insurance policies.
However, in an exclusive for North West Bylines the Information Team at Cheshire East Council clarified that “the Council’ does in fact ‘maintain a range of insurance policies’ designed to ‘mitigate a wide variety of legal and financial risks’ and ‘maximises resource allocation to manage risks in the most effective manner’ so the reader can draw is left to draw their own conclusion from the two conflicting responses.
Is Cheshire East looking to tighten up its data ship?
Finally, Mrs Broadest asked the Local Authority, ‘other than GDPR, have new and updated compliance regulations such as the proposed ransomware ban, for example DORA and NIS 2, changed how you (the Council) store and secure data within your department and organisation over the past year from January 2024 and December 2024?’
The Council confirmed that ‘During the procurement phase there are several checks carried out to provide assurance that third-party suppliers have adequate controls in place related to cyber security’.
They also clarified that ‘that 212 data breaches were reported during the period from 01/01/2024 to 31/12/2024. This represents a 10% decrease compared to the same period in the previous year, with 11 fewer incidents reported. When comparing by financial year, there was a 1% increase from 2023/24 to 2024/25, which corresponds to an additional 2 incidents reported. As explained in our response, it is important to provide context around the number of data breaches reported. The Council encourages all potential incidents to be reported, regardless of the nature or level of risk, and not all incidents reported are data breaches. However, we encourage the reporting of all incidents, including near misses and internal disclosures, as they can provide valuable insights into training, policies, and processes that may need to be strengthened’.
What is DORA?
DORA stands for Digital Operational Resilience Act, and is a European Union regulation targeted at:
‘enhancing the digital operational resilience of financial institutions and the Information Computer Technology service provider by implementing a comprehensive framework for:
- managing Communication Technology risks,
- improving cybersecurity, and
- making sure resilience to disruptions’.
The legislation is having an effect on the financial sector, obliging institutions to invest in enhanced cybersecurity measures and improve their operational resilience capabilities. However, it looks like now the United Kingdom is outside of the European Union, this does not apply and, as such, Cheshire East is not obliged to comply with it.
What is NIS 2?
The European Commission guidance in this area says that the NIS2 Directive ‘establishes a unified legal framework to uphold cybersecurity across the European Union’ and ‘calls on Member States to define national cybersecurity strategies and collaborate with the EU for cross-border reaction and enforcement’. It is designed to ‘protect:
- network and information systems (NIS);
- their users, and
- other affected individuals from:
cyber threats and incidents.
However, since the United Kingdom exited the European Community it no longer obligated to implement this Directive into the law of England and Wales and, again, the Cheshire East Council is not required to comply with it. This is the reason behind why the answer to Mrs Broadest asking ‘are you encrypting more data as a result?’ The answer to this question from the Council was a definite ‘No’.
However, Jon Fielding, the Managing Director at EMEA at Apricorn advised that this may not be the right course of action as he observes ‘Local councils and government departments are responsible for large amounts of sensitive data’ and explains Local Authorities ‘should lead by example by adopting stronger cyber insurance policies and more robust data protection measures’. Mr Fielding advises ‘Cyber insurance is not just a safeguard for financial recovery’. He explained these types of insurance products ‘encourages organisations to:
- shore up their defences,
- ensuring better compliance with regulatory standards and
- promoting best practices in data security’.
The initial response to the Freedom of Information Request demonstrates that Cheshire East does not appear to be taking its cybersecurity obligations seriously enough, for example there has been 214 potential violations of data protection law in 2024, the Local Authority does not have an insurance policy in place which would kick in and deal with a potential cyber security incident if it were to happen, and it is potentially leaving the constituents at risk of a serious data breach.
Cheshire East confirmed in a response to my email that they, ‘utilises several sources to ensure that services are delivered using best practice, these include the National Cyber Security Centre which is the national technical authority for cyber security in the UK’.
In response to my email the Local Authority noted that ‘All staff, including temporary and agency staff, are required to undertake mandatory Protecting and Managing Information e-learning as part of their induction. This training must be refreshed annually. Reminders about the expiry date of their training are issued and, if not completed, these are escalated to line managers. Managers can also review mandatory training completion rates for their areas of responsibility via a dashboard. The Strategic Information Governance Group receives a monthly report detailing compliance with this mandatory training. The e-learning content is regularly reviewed to ensure it remains effective and relevant. A recent review has been completed, and a revised version of the data protection e-learning training will be introduced over the coming months’.
