Disclosure of 46 pages of PFI contractor’s banking details by Merseyside Fire and Rescue Service described as “oversight”

Disclosure of 46 pages of PFI contractor’s banking details by Merseyside Fire and Rescue Service described as “oversight”                               The author of this piece is an Appellant in a First-Tier Tribunal (Information Rights) case involving Merseyside Fire and Rescue Authority. Today, the eighteen councillors on the Merseyside Fire and Rescue Authority met. One of the … Continue reading “Disclosure of 46 pages of PFI contractor’s banking details by Merseyside Fire and Rescue Service described as “oversight””

Disclosure of 46 pages of PFI contractor’s banking details by Merseyside Fire and Rescue Service described as “oversight”

                             

The author of this piece is an Appellant in a First-Tier Tribunal (Information Rights) case involving Merseyside Fire and Rescue Authority.

Today, the eighteen councillors on the Merseyside Fire and Rescue Authority met. One of the decisions they agreed was a constitution which includes the following (Members means councillors), “Members should avoid public criticism of individual Officers, as it is unfair and oppressive.”

Last year during the 2014/15 audit, I requested the North West Fire and Rescue PFI contract. This is the PFI contract with Merseyside Fire and Rescue Authority for the Belle Vale, Birkenhead, Bootle/Netherton, Formby, Kirkdale, Newton-le-Willows and Southport fire stations on Merseyside as well as fire stations in Lancashire and Cumbria.

After Merseyside Fire and Rescue Authority insisted I provide them with a blank DVD, a copy was provided to me on DVD which contained the entire contract. The contract (apart from 46 pages in section 4.7 (Bank account mandates and specimen signatures)) was published on this blog.

When it was published on this blog in October 2015, a former press officer working for Merseyside Fire and Rescue Service Lyndsay Young phoned me asking me to remove the contract from my blog. I explained why I wasn’t going to do so and alerted her to the 46 pages of bank account mandates and specimen signatures that I had not published.

Last week Merseyside Fire and Rescue Authority’s Audit Sub-Committee met and discussed the Corporate Risk Register which included the risk of data loss and the possibility of regulatory action by the Information Commissioner’s Office (ICO). I requested a press officer be present for this meeting so I could ask for a quote from Merseyside Fire and Rescue Service about its disclosure of this information. This request was denied.

Merseyside Fire and Rescue Service refused to comment (in part because of criticism in an article published that day about how Merseyside Fire and Rescue Authority was managed and led) and instead asked us to speak to their solicitor on Tuesday 14th June.

Deputy Chief Fire Officer Phil Garrigan (bottom left) tells Merseyside Fire and Rescue Authority's Audit Sub-Committee 9th June 2016 about the risk of data being compromised
Deputy Chief Fire Officer Phil Garrigan (bottom left) tells Merseyside Fire and Rescue Authority’s Audit Sub-Committee 9th June 2016 about the risk of data being compromised

After Deputy Chief Fire Officer Phil Garrigan’s glowing comments at that meeting about the efforts Merseyside Fire and Rescue Service had taken to prevent data loss at the Audit Sub-Committee meeting, I emailed the Merseyside Fire and Rescue Services’ auditors Grant Thornton alerting them to this and also asked the contractor Balfour Beatty for a quote.

Merseyside Fire and Rescue Service’s position changed from their original “no comment” to an email requesting that the information be destroyed or returned (offering to pay any costs of doing so).

Louise McCulloch, Head of Media & PR for Balfour Beatty kindly gave us the following quote, “Last year, information relating to [the] North West Fire and Rescue (NWFR) [contract] in which Balfour Beatty has an interest, was inadvertently shared with an individual as part of a response to their request to the Fire and Rescue Authority under s 15(1)(a) of the Audit Commission Act 1998.

The Authority made NWFR fully aware of the oversight immediately. NWFR has taken the necessary steps to ensure no adverse impact.

NWFR has asked the Authority to request the individual destroy or return the information which has no public interest, which Merseyside Fire and Rescue Service has done.”

The 46 pages of disclosed information contain details of sort codes, account numbers, specimen signatures and names of those authorised to use various Barclays Corporate bank accounts connected to the PFI fire stations project run by Balfour Beatty.

Clearly this information should not have been disclosed to me, but it is worrying that Merseyside Fire and Rescue Service seemed to only realise this had happened after I told them first in October 2015 and again in June 2016!

If you click on any of the buttons below, you’ll be doing me a favour by sharing this article with other people.