The Electoral Commission (EC) finally admitted yesterday (Tuesday) that it had been the victim of a cyber-attack which meant "hostile actors" had accessed electoral registers. The register holds the details of almost 43 million voters. The Police Service of Northern Ireland have also been hacked, meaning details of serving officers are in the public domain.

The attack on the EC was discovered in October last year, with the breach having occurred fourteen months before that. Yet it had been covered up until now. The EC claimed most details were available on open record, but Sky News calculated that “almost 28 million people opted out of the open register that year.” Fifteen million out of 43 does not qualify as “most”.

Under the General Data Protection Regulation (GDPR), in the event of a personal data breach, data controllers are required to notify the affected data subjects "without undue delay." Specifically, Article 34 of GDPR says that when a personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the data controller must communicate the personal data breach to the data subject without undue delay. It doesn't say how quickly, but eight months!? If this was a large corporation, they would be hauled over the coals.

When the saga around Coutts’ efforts to de-bank Nigel Farage emerged, one of the potential reasons floated was that he was a PEP – a politically exposed person. Now we have a situation where the hackers have the details of the Leader, the Nominating Officer and the Treasurer of every political party in the land.

Never have those people been so exposed as they are now.

If you want compensation as an individual, you must sue the Electoral Commission. But then you’ll likely get a tax rise to pay for it. I suppose we can expect those civil servants responsible for this debacle to get a bonus any day now.

Martin Day – Party Secretary