WAVERLEY Borough Council has been found guilty of a string of data protection breaches, including spying on a former senior employee’s private emails.

According to the Information Commissioner’s Office (ICO), Waverley began automatically diverting the ex-employee’s personal emails to the council’s head of human resources, Wendy Gane, last August, without the ex-employee’s knowledge or consent – nor that of the emails’ recipients.

Those emails, sent from the ex-employee’s home email address to former colleagues, included many of a private nature not related to council business, as well as correspondence with union representatives sensitive to the ex-employee’s ongoing dispute with the council.

In its defence, Waverley claimed all employees are informed their personal emails may be forwarded to human resources “in order to respond to time-sensitive employment matters”.

But the ICO ruled staff were not suitably informed this applied to every email sent to the council - adding the automatic diversion of emails should only be adopted in “exceptional circumstances”.

ICO case officer Helen Jackson said in her judgement: “On balance based on the information provided it appears that Waverley Borough Council has breached the Data Protection Act 1998.

“In particular this appears to be a breach of the first data principle (information must be processed fairly).

“We do not feel the processing warning made it sufficiently clear all emails you send to the council would be ‘automatically diverted to HR’.

“From the wording and context of the email an individual may have assumed only emails relating to employment concerns and sent to key officers would be diverted to HR.

“We would only expect emails to be automatically diverted or intercepted in exceptional circumstances.”

Waverley was also found to have breached the 198 Data Protection Act by failing to respond to the former employee’s request for all of their personal information held by the council within the prescribed 40 days.

ICO accepted Waverley’s explanation that due to the large amount of information generated by the search for information, including 23,000 emails, it was not possible to provide a full response within 40 days.

But the council committed another breach when belatedly releasing the information in September, mistakenly disclosing a confidential letter from a third party as part of its response to the request.

Waverley discussed the matter with the individual whose data had been disclosed and it was decided the matter would not be pursued any further.

And since concerns around its automatic diverting of emails were raised, Waverley has also taken steps to ensure employees who are union representatives have a dedicated non-council email address from which they can correspond with union members privately.

The ICO has also opted against taking any further action against Waverley, instead recommending that the council avoid the automatic diversion of emails in future as well as ensuring all information is “thoroughly checked in future” before disclosures are made.

But the former employee, who has asked to remain anonymous, expressed disappointment that Waverley escaped any sanctions.

They said: “I appreciate that [ICO] are the experts and have responded as they feel appropriately but I think given Waverley breached a fundamental piece of legislation three times against me, a single ex-employee, I would be really concerned about how they are treating other’s data.

“I have requested a manager’s review of my case with the ICO as I feel Waverley should be subject to some kind of sanction.”

A council spokesman said: “Waverley Borough Council takes the management of personal data extremely seriously.

“We have been in correspondence with the Information Commissioner’s Office following a complaint from a former employee and acknowledge the recommendations it has made to the council, which are being followed.

“Staff emails are never redirected to the HR department in any circumstances. Waverley adopts best practice when it comes to IT management and has a robust acceptable use ICT policy.

“The policy, which all staff agree to and sign when commencing employment at Waverley, clearly sets out the council’s approach on IT usage.

“In exceptional circumstances, for example when dealing with persistent complainants, the council may take the decision to channel all external emails to a single point of contact.

“This is to ensure those customers receive a consistent and speedy response from the council.”