A family has called on Cornwall Council to improve its handling of personal information after discovering that details about their children had been sent to strangers.

The data breach was discovered when the family, who have asked not to be identified, opened up an envelope sent to them regarding their children’s school transport.

Inside the mailout, the couple found that not only did they have details about their own application but they also found information about other children who were applying for transport.

By coincidence they knew one of the other families and contacted them to see if it was anomaly, but were surprised to find that they had also been sent personal information about someone else’s children.

The family immediately contacted the council to let it know that they had been sent the information in error.

They claim that the person who called them back appeared “panicked” about the data breach and immediately apologised for the error. The council confirmed to the family that their children’s information had also been sent to someone else.

The dad said: “I scanned the information about someone else that we had received and emailed it to the council. They acknowledged receipt of it but I was amazed that they didn’t ask me to delete the email and destroy the paper document.

“I think that shows how they handle people’s information. They need to be more careful, we don’t know who has our children’s information.”

The couple said they appreciated that there was no sensitive information in the paperwork but said they were still concerned that personal information – including their children’s names, dates of birth, address and school – had been sent out to strangers.

The mum said: “We don’t know who has got our information and in the horrible world that we live in that could have gone to anyone.”

The dad added: “It is human error but they are supposed to be an organisation that you can trust with your details.

“They do handle sensitive information and also have people’s bank details to direct debits for council tax and so on. You would want to know that an organisation like that is being careful.

“They have said that there will be an internal investigation but what will happen after that? If this was a company then they would be apologising and offering some kind of compensation or gesture of goodwill. The council aren’t going to give me a reduction on my council tax are they?

“I’m just concerned that while they will say that lessons will be learned I want more of a guarantee that they will improve their systems.”

In a statement Cornwall Council said: “Last month, under the school transport appeal process, information was issued incorrectly to five parents. As soon as the council became aware of the error the parents involved were contacted, information was retrieved safely and an apology was made immediately.

“The council processes large volumes of personal data on a daily basis and takes responsibility to protect personal data very seriously. As a result of this error the procedures around sending out information on appeals were immediately reviewed and a number of changes have been made to prevent this from happening again.”

The couple spoke out about the data breach after reading earlier reports of a breach where an email was sent out to 155 parents of disabled children with their email addresses passed to every recipient. The council on that occasion apologised and said it would improve.

Cornwall Council strategic director for neighbourhoods Paul Masters recently told councillors at a briefing that the council had had around 200 “information losses” in the past year. He said that most of these involved information being sent to the wrong address.

However he also revealed that the council had only ever been subject to a formal investigation by the Information Commissioner once and that only resulted in advice being given to the authority.