The Hidden Risks of Information Disclosure: A Costly Lesson from Cornwall

The piece recounts how Royal Cornwall Hospital, in responding to a routine Freedom of Information request in 2023, exposed sensitive staff data when a spreadsheet published on its website contained hidden sickness absence information. The dataset affected 8,100 current and former employees and spanned three years, with the breach only coming to light after someone who accessed the file flagged it to the hospital.

The incident underscores risks that can arise even from well‑intentioned information requests if proper safeguards are not in place. The report highlights a broader vulnerability: metadata and hidden content in electronic documents such as spreadsheets, Word documents and PDFs can remain recoverable and unseen in normal views, as illustrated by Cornwall’s case.

According to Workplace Privacy, Data Management & Security Report, this hidden data in documents represents a critical factor organisations must address to prevent inadvertent disclosures. The hospital subsequently apologised for the disclosure, emphasising the need for stricter safeguards around information requests.