‘Human error’
City law firm Kennedys has apologised “unreservedly” after a data breach exposed the email addresses of people signed up to receive updates on the Church of England’s redress scheme for survivors of Church-related abuse.
Kennedys, which has been acting as the independent administrator of the scheme since March 2024, admitted that on Tuesday evening it sent an update to 194 individuals and law firms — but failed to conceal recipients’ details.
“Due to human error, the email displayed the email addresses making them visible to all of the recipients. No further personal details of individuals were shared. Attempts to recall the message were only partially successful,” Kennedys said in a statement.
The firm said it has contacted everyone affected, reported the incident to the Charity Commission, the Information Commissioner’s Office and the Solicitors Regulation Authority, and launched a “full internal investigation” into the breach.
“Kennedys is deeply sorry for the hurt and concern caused to everyone affected by this significant error and accepts full responsibility,” it said. “We understand the significant impact this will have on those affected for which we apologise unreservedly.”
The Church of England said it was “profoundly concerned” by the incident and recognised “the distress this has caused, particularly for survivors who trusted the scheme to handle their information with care and confidentiality”.
It added that it is “in discussions with Kennedys to understand how this breach occurred and to ensure robust steps are taken to prevent anything similar from happening again”, and said it will continue to “monitor the situation closely and support efforts to restore trust and confidence”.
The redress scheme aims to provide support to survivors of Church-related abuse.
