EXCLUSIVE: ACE apologises following ‘concerning data breach’

Arts Council England (ACE) has apologised to cultural organisations after ticket sales figures uploaded to the controversial Illuminate platform were made publicly available online.

As part of efforts to “share insights” about ACE-funded events, dashboards featuring 2023/24 data were published on 7 March, allowing users to “drill into the data”.

Among the filters available was “ticket type”. Selecting this filter created a dropdown list featuring the names of individual cultural organisations, allowing access to data on their ticket sales.

Organisations affected include Arcola Theatre, English National Ballet, Kettle’s Yard, Kiln Theatre, Lyric Hammersmith Theatre, Opera North, Brixton House, Lowry and Bournemouth Symphony Orchestra.

In a statement issued to Arts Professional, ACE said the ticket type options were based on the names organisations had given to the different ticket types they offer. It said this information was published “in error” and related to 49 organisations out of more than 1,000 organisations on the platform. The information was subsequently taken down by ACE earlier this week.

ACE has notified all identifiable organisations, and said it is reviewing processes with Illuminate’s developers, PricewaterhouseCoopers (PwC), to “ensure something of this nature doesn’t happen again”.

It added no commercial financial data, such as profit made from different ticket type sales, was shared via the filter.

‘Huge data breach’

One source told Arts Professional that the dashboards featured “a crazy level of granularity” and the situation represented a “huge data breach”.

An Arts Council England spokesperson said: “Our Illuminate platform gathers data from cultural organisations to support analysis and audience development, while also allowing us to build a stronger understanding of, and case for, investment in our sector.

“We are aware that a comparatively small amount of information, not intended for publication, was added to our newly launched audience data dashboards.

“We are sorry for this mistake and have worked quickly to review the dashboards, make swift changes, and have informed and apologised to the organisations this relates to.

“We encourage users to continue to provide feedback on Illuminate, as we’re dedicated to developing a platform that is the most useful for the sector – both in aggregating data, and interpreting it”.

Data on children

ACE has also removed data added to the dashboards related to under-16s. It said that while the Illuminate system does not ask for data relating to under-16s, if an organisation uploaded data they had already collected – including any related to under-16s – it was added to the system and subsequently appeared on the dashboard.

“We appreciate that for some organisations, under-16s are a key demographic, and they will have appropriate processes in place to support this data collection,” ACE said.

“That’s why we allow for this data to be added to Illuminate, for their own audience development and analysis purposes. But for clarity, we will no longer present this information in aggregate on our public dashboard.”

The situation comes on the back of a series of issues with the Illuminate platform. After launching late, cultural leaders expressed concerns about its useability.

In September 2023 ACE informed National Portfolio Organisations and Independent Sector Support Organisations that it was temporarily dropping some of the reporting requirements that are a condition of the funding they receive.

Leaders in the arts sector have previously said they felt PwC “had no idea what it was in for” when it won the contract.

“The platform seems to have been designed chiefly for large, ticketed venues – though they don’t seem thrilled with it either. Everything else seems to be a bit of a workaround,” they said in an open letter to ACE in January 2024.

PwC ‘falling short’

Another source within the sector said that when the Illuminate dashboards launched it “took less than five minutes to filter down to the data for an individual production”.

“Despite the fixes put in place, it’s still possible to use the dashboards to single out events, particularly because of the granular date range filter,” they said.

“How many large-scale all-day dance events were there in the North East over a specific couple of days in 2024? One.”

While ACE has said it intends to extend the current National Portfolio by two years up to the end of March 2028, the contract for the Illuminate data platform ends in March 2026.

ACE is yet to say what will happen to Illuminate beyond that date.

The source told Arts Professional that the PwC contract has been “poor value for money”.

“I don’t think it will come as any great shock when I say Illuminate is falling short. I think there’s a real public interest in that contract being published,” they said.

“Yet all the rumours behind the scenes are that Illuminate will continue [beyond March 2026], either under the egis of PwC, or even brought in-house to ACE.

“Some of the evidence ACE is relying on to submit evidence to the zero-based Comprehensive Spending Review is based on this system – it’s not unreasonable for people to be concerned.”