Law firm email blunder exposes Church of England abuse victim details
Apology issued after names tied to redress scheme revealed in mass mailing
A London law firm leaked the details of nearly 200 people who requested to receive updates about the redress scheme set up for victims of abuse at the hands of the Church of England (CoE).
City firm Kennedys Law confirmed that due to "human error," the email addresses of 194 individuals and law firms were exposed to all recipients.
It said it made attempts to recall the emails, but these "were only partially successful."
The redress scheme, established for victims of abuse by those who held positions of power in the Church, including priests and bishops, was only recently set to start opening its application process after a bill was approved in July to begin its passage to law.
"Kennedys is deeply sorry for the hurt and concern caused to everyone affected by this significant error and accepts full responsibility," it said in a statement. "We have contactedeveryone who received the message and have reported the incident to the Charity Commission, the Information Commissioner's Office and the Solicitor's Regulatory Authority. We will fully comply with any investigations.
"We understand the significant impact this will have on those affected for which we apologise unreservedly. We remain committed to supporting victims and survivors of Church of England-related abuse to secure the financial redress, therapeutic, spiritual and emotional support, acknowledgement of wrongdoing on the part of the Church, apology and other forms of bespoke redress under this scheme."
The law firm added that an internal investigation was launched to understand how this happened, promising to incorporate all learnings "immediately."
The CoE said: "While the Church of England is not the data controller for the Redress Scheme and does not hold or manage the data in question, we are nonetheless profoundly concerned. We are in discussions with Kennedys to understand how this breach occurred and to ensure robust steps are taken to prevent anything similar from happening again.
"This should not have happened. We will continue to monitor the situation closely and support efforts to restore trust and confidence."
Cases of CoE abuse date back decades. The Independent Inquiry into Child Sexual Abuse (IICSA), published in 2022, revealed that between the 1940s and 2018, 390 Church associates were convicted of child sex abuse crimes.
It also noted that until 2015, the CoE's safeguarding arrangements – which represent 85 million Anglicans globally – were under-resourced.
This changed in late 2015, around a year after the idea of a redress scheme was first discussed between survivors and Church officials, according to the House of Survivors group's timeline.
Over the years, the number of victims at the CoE alone is estimated to be in the many thousands, including children, teenagers, and adults.
Church dioceses received 3,287 reports of concerns and allegations in 2017 alone, representing a 50 percent increase compared to 2015.
Numerous convictions have been secured in recent years, and former long-serving Archbishop of Canterbury, Justin Welby, was forced to resign in 2024 over his failure to investigate claims of historical abuse.
"The Church of England failed to respond consistently to victims and survivors with sympathy and compassion, accompanied by practical and appropriate support," the IICSA noted. "This often added to the trauma of those who had experienced child sexual abuse by individuals connected to the Church.
"While there have been important improvements in child protection practice, the Church of England still has more to do to rebuild the trust of victims and survivors. Some internal past case reviews were flawed and inaccurate, and there was a tendency to minimise offending."
The incident, which is the latest of the many ways CoE abuse victims have been failed over the years, is just one in a litany of email-related failures that have affected vulnerable people in the UK and abroad.
The most notable case in recent years was the Ministry of Defence's infamous leak of the 19,000 Afghan individuals who worked with British armed forces in fighting the Taliban, which also included British spies and SAS troops.
Standard email etiquette became so concerning in 2023 that the Information Commissioner's Office was forced to issue a reminder of the dangers associated with confusing CC and BCC.
It cited cases involving an NHS Trust and an unspecified charity, which exposed the identities of patients and members of an HIV advisory board, respectively. ®