Information relating to 265 people, including 63 commercial/public entities, was released in error through a Freedom of Information request in March 2024, with the data breach only coming to light a year and a half later, the AERA Committee has been told.

Officials from the Agri-Food and Biosciences Institute (AFBI) attended Thursday’s AERA meeting at Stormont to outline the conclusions and actions following a report in December into its data breach, which was discovered last October.

Dr Stanley McDowell, chief executive officer of AFBI, outlined the conclusions of the independent report into the data breach.

He told committee members how the data breach had come to light following the receipt of a media inquiry on 2nd October 2025 which made reference to data issued by AFBI in response to an FOI request in 2024. Review of that request raised concern that information had been incorrectly released and AFBI activated its data breach procedures. It was very quickly established that personal data had been disclosed in error in response to the FOI request in March 2024.

Committee members were told that by providing an answer to the FOI request, data had been extracted from a laboratory database into excel format. It had been further filtered to obtain the requested information and while personal data was redacted for visible records, due to the application of the filters, reviewers and approvers did not observe, as part of their review process, that the spreadsheet contained other records and personal data for those records.

Dr McDowell said: “Following discovery of the breach we moved very quickly and took a number of immediate actions including notification to those whose data had been breached. Letters were issued on Saturday, 4th October. AFBI also wrote to the recipient of the data reminding them of their data protection obligations and asked them to delete the data which had been issued in error. A call and email handling facility was mobilised which was operational from the following Monday.”

He said that internal investigations were undertaken. It was found that overall AFBI had well defined processes in place for data management and the release of the information was as the result of human error rather than deficiencies in the design of the system or absence of controls.

Dr McDowell apologised for the breach, but stressed that as an organisation they are “absolutely committed” to implementing the recommendations of the internal investigation which strengthen the controls that were already in place. AFBI has since taken a number of immediate steps including mandatory refresher training for all staff.

Commenting is now live on the News Letter - comment on our articles and join the debate

AERA chairman Robbie Butler, asked what steps AFBI had taken in regard to help for those affected by the breach, particularly in relation to the impact on mental health.

Dr McDowell said there was an immediate telephone and email helpdesk set up which operated for a number of weeks. The call centre was mobilised on Monday 6th October – with 24 calls received in the first week – and 57 in total over a four week period.

AERA members heard that AFBI has attempted to contact the person who was the recipient of the information in March 2024, with little success.

Dr McDowell said: “Unfortunately for the recipient we only have an email address for them. But we have taken legal advice in relation to it and there has been the original letter from ourselves, and the letter from the legal team and we further asked the question of the Information Commissioners Office. We have taken legal advice in terms of our options. Unfortunately when we only have an email address there’s limitations for further steps that can be undertaken.”

Committee members heard the information related to salmonella isolations. Dr McDowell said this is something that occurs in animal species and is “not particularly newsworthy”.

“While I obviously understand farmers might not want that data to be in the public domain, it is unlikely to have individual impacts on farmers given that this is something that occurs on farms,” he added.

Of the 265 people affected – 63 were commercial/public entities. Declan McAleer asked if any of the information released could be commercially sensitive or negatively impact on those commercial enterprises.

Dr McDowell said there were various commercial parties within the data breach and AFBI had reached out to them in the days following it to allow them to do their own independent assessement around that issue.