The Post Office has launched an urgent investigation after it published the names and addresses of 555 postmasters prosecuted during the Horizon scandal. The list was removed soon.
The leaked document contained the names of 555 former subpostmasters who sued the Post Office in 2019. In 2019, the firm agreed to pay them £58 million in compensation, but much of the money went on legal fees.
The company confirmed staff had shared personal details in a document on its website on Wednesday (19). The Post Office said it had referred itself to the Information Commissioner’s Office over the breach.
The leak of information comes as witnesses continue to give evidence at an inquiry into the Horizon IT scandal, which saw hundreds of sub-postmasters prosecuted for stealing between 1999 and 2015 due to incorrect information from accounting software.
Daily Mail reported that Post Office published on its corporate website a dossier of 555 wronged postmasters who were involved in suing the Post Office in 2019, showing their full names and home addresses including postcode, making it easy for anyone to find them. Many are poised to receive significant sums of money in compensation for Britain's biggest ever miscarriage of justice, and told of their anger at their home addresses being exposed.
Humiliatingly, the document containing the details is entitled 'Confidential Settlement Deed' and spells out in black and white that its contents are private. It is even signed by the Post Office's own senior lawyer – and yet it has been posted onto its website in full.
The names and home addresses are listed in a 47-page legal agreement, signed on 10 December 2019, which brought the High Court class action to a settlement mid-way through the trial. The Post Office apparently intended to publish on its website a 'redacted' version of the legal agreement, with personal details covered by a censor's black ink. But instead, the document was posted with everyone's personal details on full display.
Raoul Lumb, a partner at law firm SMB who specialises in data protection, said it appeared "a remarkable breach" of the UK's data protection laws known as GDPR and showed"'a cavalier disregard for the rights of sub-postmasters".
Post Office said the document had been removed from its website.
Report quoted Post Office as saying, “We are investigating as an urgent priority how it came to be published. We are in the process of notifying the Information Commissioner’s Office (ICO) of the incident, in line with our regulatory requirements.”
An ICO spokesman said, “We have not received a data breach report on this matter. Organisations must notify the ICO within 72 hours of becoming aware of a personal data breach, unless it does not pose a risk to people’s rights and freedoms.”
The incident has angered post office operators – some of whom are still waiting for compensation. Many have had their lives ruined and suffered bankruptcy, prison sentences and homelessness after they were wrongly prosecuted in what MPs have described as the worst miscarriage of justice in British legal history.
