Lawyers react to data breach affecting personal information of survivors of Church of England abuse

The individuals had registered to receive updates on a scheme set up to provide redress for survivors of abuse in the Church of England. 

On Tuesday evening, Kennedys Law, a law firm appointed to administer the Redress Scheme, sent an email to 194 individuals and law firms who had registered to receive updates on the scheme. Due to human error, the email mistakenly displayed the email addresses of all recipients, revealing them to all the other recipients.

In a statement, Kennedys said that it was “deeply sorry for the hurt and concern caused to everyone affected by this significant error and accepts full responsibility... We understand the significant impact this will have on those affected for which we apologise unreservedly”.

Kennedys also confirmed it had contacted everyone who received the message and reported the incident to The Charity Commission, the Information Commissioner’s Office and the Solicitors Regulatory Authority. Kennedys confirmed it has launched a full internal investigation to understand how the data breach could have occurred and will incorporate any lessons learnt into its procedures immediately.

In a separate statement, the Church of England stated that it was “profoundly concerned” about the incident. It confirmed it was in discussions with Kennedys to understand how the breach occurred and to ensure robust steps are taken to prevent anything similar from happening again.

The Church also said:

“We recognise the distress this has caused, particularly for survivors who trusted the scheme to handle their information with care and confidentiality... This should not have happened. We will continue to monitor the situation closely and support efforts to restore trust and confidence.”

Sean Humber, data breach specialist at Leigh Day, said:

"This is clearly a serious data breach of what is extremely sensitive information. It is right both that the solicitors appointed to administer the Redress Scheme have accepted responsibility and apologised and also that the Church have recognised the distress caused by the incident.

"Those affected by the data breach are likely to have significant claims for compensation in relation to any distress or anxiety caused by the unauthorised disclosure of this sensitive information."

Alison Millar, head of abuse claims at Leigh Day, said:

"As someone who specialises in representing survivors of abuse, I am really concerned about the impact that this data breach is likely to have on the individuals affected. 

"It often takes survivors decades before they are ready to make a disclosure of abuse. Taking the step of registering their details with the institution that harmed them, and so putting their trust in that institution to deal with them, will not have been a step that the individuals involved will have taken at all lightly.

"This data breach will have left those affected feeling exposed, vulnerable and extremely let down.

"It undermines the credibility of the Church’s redress scheme before it has even started and many will feel that, far from being an isolated incident, it is just the latest in a long series of failures by the Church of England in safeguarding. It is essential that the Church now urgently takes steps to ensure that those affected by this are safe and supported."

If you have been affected by the data breach and wish to receive more information, in confidence and without obligation, about bringing a claim for compensation on a “no win, no fee basis” then please contact us by email to infobreach@leighday.co.uk or by telephone on 020 7650 1340.