Shocked Cornwall mum sent strangers' adoption details by Devon council
- trushali Kotecha
- Dec 28, 2025
- 2 min read
By Olivier VergnaultSenior Reporter
06:00, 22 DEC 2025
It is a serious data protection breach
Devon County Council headquarters in Exeter (Image: BBC)
A mum in Cornwall has been left shocked and angry after a data protection blunder saw her receive confidential adoption information from Devon County Council when it has nothing to do with her or her family.
Earlier this week, the local authority's adoption services shared the sensitive information about two children, aged 10 and 2, along with their adoptive parents' details, with Lauren Hicks, a complete stranger who lives in Cornwall.
The email shows what she sees as utter incompetence from Devon County Council as it represents a serious General Data Protection Regulation (GDPR) breach for the local authority.
It contained names and dates of birth of the two children, the names and addresses of the adoptive parents and a copy of their adoption contract from Adopt South West as well as the parents' contact details including phone numbers and email addresses.
Lauren, from Penzance, said the data breach had resonated with her on a personal note.
She said: "It made me feel angry for the family and worried about my own children as, in the past, an old social worker breached confidentiality and put someone else's cases notes in mine.
"My son has severe autism and ADHD (attention deficit hyperactivity disorder), I put him in care voluntarily in 2015. Thankfully he lives with an amazing lady, however it makes me worry his data has been breached.
"My eldest child has not had any experiences like this. I did ask her but it makes me extremely worried for my own son and other people's children in the system. It's outrageous."
Lauren also shared with us the messages she has received from the team manager with the Maintaining Relationships team at Devon County Council, who tried to explain the hiccup and asked that she deletes the information she received in error.
In her message to Lauren, dated Tuesday (December 16), the council's team manager said: "I am contacting you as a member of our team has sent you an email this afternoon in which she accidentally included your email address.
"The email was not intended for you and was not in connection to any of your children. Please accept my sincere apologies that you received the email in error; we take a lot of steps to try and ensure errors such as this don't occur.
"I would be very grateful if you could delete the email you have been sent without reading it and let me know that you have done so."
A spokesperson for Devon County Council added: "We take our responsibilities under data protection laws extremely seriously and are investigating what has happened in accordance with our Security Incident Management Policy and Procedure.
"Our investigation will explore what contributed to this incident, with a view to addressing any improvements to our processes that may be necessary to reduce the chances of this happening type of incident happening again.
"This matter has been reported to the Information Commissioner’s Office in accordance with our obligations under the Data Protection Act 2018."
Comments