FOI reference: FOI-2026-3788
You asked
Please provide the following, for each calendar year 2023, 2024 and 2025, and for 1 January 2026 to the date of your response.
1. DATA BREACHES AND SECURITY INCIDENTS
a) The number of data protection breaches, information security incidents or near misses your department recorded where a member of staff or a contractor entered, uploaded or pasted official information into a generative AI tool.
b) For each incident in (a), or as totals if that is easier:
which tool was involved;
the highest government security classification of the information (OFFICIAL, OFFICIAL-SENSITIVE, SECRET or TOP SECRET);
whether it included personal data, and roughly how many people's data;
whether the incident was reported to the Information Commissioner's Office.
2. DISCIPLINARY ACTION
a) The number of disciplinary investigations or cases involving staff misuse of generative AI tools.
b) The outcome of each case, for example no action, informal warning, written warning, final written warning, dismissal, or resignation before the outcome
c) Of the cases in (a), how many related to entering official information into a generative AI tool, and how many related to other misuse, such as using AI to produce work presented as the person's own.
SHORT DESCRIPTIONS (ONLY IF POSSIBLE)
a) For each incident counted in Part 1(a), the short description recorded in your breach or incident log, with names, job titles, teams and exact dates removed. One line per incident is enough
b) For each case counted in Part 2(a), a one-line anonymised summary of what the misuse was, with names, grades, teams and dates removed.
We said
Thank you for your request.
All Office for National Statistics (ONS) staff have access to M365 Copilot, which is an artificial intelligence (AI) productivity tool embedded within Microsoft 365 applications such as Word, Excel, Outlook and Teams, governed by existing ONS user permissions.
Within the ONS, an AI Leadership Group, alongside clear staff guidance, policies and training, ensure that the same high level of compliance with security, legal and ethical requirements continues to apply to all ONS data.
As regards your specific questions, disclosure of this type of information would prejudice our ability to prevent or detect crime. Knowledge of the existing effectiveness of our security measures and the types of tools and actions we can detect would allow a malicious actor to identify and exploit possible vulnerabilities. Disclosure of this information would therefore increase the risk of a targeted and successful attack on our systems. As such, disclosure would prejudice the prevention or detection of crime and the exemption found under s.31(1)(a) of the Freedom of Information Act 2000 (FOIA) is engaged.
This exemption is subject to a public interest test. We recognise that releasing this information would aid transparency and accountability of the ONS, particularly regarding the security of the data we hold. However, we see greater value in the inherent public interest in crime prevention. The ONS holds a large number of records containing sensitive personal information about business and individuals and we take our duty to safeguard this information very seriously. There is a strong public interest in preventing the disclosure of any information that would increase the possibility of a successful attack, which has the potential to cause emotional and financial distress and a loss of public trust in the ONS. The public interest test falls in favour of withholding this information.
We can, however, confirm that we've had zero incidents that have posed a risk to the rights and freedom of individuals.