Pembrokeshire: Top councillor accused of possible data breach

A senior councillor has been accused of creating an online voting system that could have potentially allowed members' votes on budget cuts to be tracked.

Opposition members in Pembrokeshire council raised concerns about an external site containing sensitive information, the link for which was distributed by councillor Alec Cormack.

Some councillors questioned whether it could be used to track confidential responses.

Mr Cormack declined to comment.

Pembrokeshire Council has said its investigation found that no confidential or personal information had been disclosed.

Opposition councillors have told BBC Wales that the authority's statement does not allay their concerns that their activity could potentially have been tracked on the website.

The council needs to save £28m during 2023-24, and councillors will soon be expected to vote on budget proposals.

The BBC has learned that councillors received an email containing an individual link from Mr Cormack, who is the council's cabinet member for finance, prior to a budget seminar on Friday 27 January.

The private individual links connect to an external website, pembs.net, which includes information about potential budget savings for the forthcoming budget, and another page for councillors to vote on various options.

It is not clear why the website was set up externally rather than on the council's own server.

The email to councillors was sent from Mr Cormack's council email address, but links to an external website which is hosted on a server that includes a number of websites, including one for his own IT business and Pembrokeshire Liberal Democrats.

Mr Cormack, a Liberal Democrat, is described on his corporate website as a "proven IT leader" with 20 years' experience in corporate IT.

It is understood concerns about the security of the website were raised during the budget seminar, which was held at County Hall, Haverfordwest.

After the row, councillors refused to vote on possible budget options using the website.

One of those who was unhappy was councillor Jacob Williams.

When approached by the BBC, Mr Williams said that because Mr Cormack was the administrator of the site, he was theoretically "able to record each and every member's interactions and save that data to use for his own purposes", which would amount to a "gross breach of trust".

Another opposition councillor, who did not want to be named, told the BBC the website in question could have breached data protection laws, as he claims the website had no obvious privacy or cookie policy.

Cookies can technically be used to track a user's browsing activity.

Alec Cormack declined to comment when asked about the concerns, and referred all enquiries to Pembrokeshire council.

The external website has now been taken down.