No action taken against SIC over Stuart Hill data breach

NO ACTION has been taken against Shetland Islands Council (SIC) after a data breach allowed Stuart Hill to access the names and addresses of 130 people in council tax debt.

The Information Commissioner’s Office (ICO) had been investigating the breach, which the council reported itself to the ICO, after Hill wrote to people who owed council tax in July 2024.

However the ICO said “no formal action” had been taken against the council following the investigation.

“After assessing the information, advice was provided to Shetland Islands Council,” it added.

It is understood Hill obtained a council document and managed to remove redacted sections to get the information.

Sovereignty campaigner Hill wrote to more than 100 people in February, advising them a council data breach had allowed him to access their personal information.

Suspected data breach puts list of council tax debtors in hands of Stuart Hill

In his letter, Hill said it was a “measure of the data security at the Shetland Islands Council” that he had been able to access the information.

He said the SIC has “absolutely no authority” to charge council tax and invited people to join the Sovereign Nation of Shetland.

Hill told recipients he was “not intending to use this information for any purpose harmful” to them.

Shetland Islands Council confirmed the breach a day later, and said Hill had not accessed the financial information of any of the people affected.

It said the breach had not come as a result of a cyber attack or a phishing exercise, but did not say how he had come to access the information.

The SIC said this week the ICO was “satisfied that our organisation is taking the matter seriously, trying to put it right and reduce harm to vulnerable individuals.

“The council will continue to implement the improvement actions that we advised the ICO we had put in train following the breach.”