Smithfield Says Employee Records Mishap Was Not Reportable Data Breach

SMITHFIELD — Town employee records containing Social Security numbers were sent to members of the Smithfield Town Council without being redacted, prompting a council member to flag the issue and the Town to review how sensitive employee information is handled.

Town Attorney Bob Spence said the records were provided as part of a request from a council member seeking financial figures to better understand budget issues.

According to Spence, Interim Town Manager Kim Pickett asked a Finance Department employee to provide the records to her so they could be included with other information being sent to council members.

“The employee did not redact information like social security numbers that could be redacted,” Spence said.

A council member subsequently noticed the records had not been redacted and raised the issue with Town officials.

Johnston County Report emailed Pickett seeking information about the incident, including what employee information had been distributed and what steps the Town had taken afterward. Pickett did not respond to the questions.

Spence later responded on behalf of the Town.

“The email never actually left the council assuming no party sent it out,” Spence said. “Again, my understanding is that the figures did not go out of the council.”

Spence added that he had not personally reviewed the records.

“I frankly have not seen them,” he said.

Because Town officials believe the records were not distributed beyond the council, Spence said Smithfield does not consider the incident a reportable data breach.

“If the email never left the council, then no employee should be at risk from disclosure of these records,” Spence said.

He said there was no need for outside agencies to be notified and no additional action was required because the records had not been publicly disclosed.

“It is not a reportable breach and no third-party agencies need be notified,” Spence said.

North Carolina law places specific restrictions on Social Security numbers and other identifying information maintained by state and local governments.

Under state law, Social Security numbers and other identifying information are confidential and are not public records available for general public inspection.

The law also states that when government agencies possess Social Security numbers or other identifying information, they should minimize how often that information is disseminated both within government and to the public.

Municipal personnel records are separately protected under state law, although government officials may inspect certain confidential personnel information when access is considered necessary for a legitimate governmental function.

Nothing in the information provided by Spence establishes that the records were sent outside Town government or used improperly after they reached council members.

State law also does not make every internal disclosure of unredacted personal information a reportable security breach. A reportable breach generally involves unauthorized access or acquisition coupled with illegal use, the likelihood of illegal use or a material risk of harm.

Still, the Social Security numbers were apparently not needed for the budget figures the council member had requested.

Spence said the incident showed the need for Town employees to more carefully review records before forwarding them.

“Nevertheless, a council member noticed that the sheets had not been redacted and that the issue should be addressed as an improvement of procedure which could help in the future,” Spence said.

He said the Town has since reviewed its procedures and reminded employees that confidential information should generally be removed before records are forwarded.

“What is important is that employees understand they are to catch submittals like these and in the future make sure that they are redacted unless they are specifically instructed not to do so because they will not be released,” Spence said.

Staff members should not assume records containing sensitive information will remain internal, he added.

“They should not assume they will not be released.”

The Town of Smithfield did not disclose how many employees had their Social Security numbers included in the records mistakenly emailed to council members.