ICO action against Met highlights the limits of policies and training reminders
The Information Commissioner’s Office has issued the Metropolitan Police Service with an enforcement notice and reprimand after investigating two highly sensitive disclosures of personal information.
In the first incident, an officer served unredacted documents on a defendant in a Stalking Protection Order case. The material included the victim’s new address and telephone number, as well as the contact details of three witnesses. The defendant subsequently contacted the victim using the disclosed number.
The second incident concerned people targeted in the parliamentary ‘honeytrap’ investigation. An officer emailed 18 affected people using the ‘To’ field, allowing every recipient to see the names and email addresses of the others. Although the message did not expressly identify the circumstances involving each person, its context allowed highly sensitive information to be inferred.
The ICO concluded that these were not simply two isolated mistakes. It identified deficiencies in specialist training, document preparation, quality assurance, mandatory data protection training completion, monitoring and governance. One officer had not completed relevant training for more than four years, while wider training completion rates remained low.
Having policies, issuing reminders and making training available will not establish effective organisational measures if completion is not monitored and important procedures are not consistently followed. Controllers handling high-risk information should be able to demonstrate quality-assurance arrangements, escalation mechanisms, training completion and action taken where staff fail to comply.
The enforcement notice requires the MPS to make improvements within three and 12 months.
For more information, see our course on Data Protection Essential Knowledge – Level 1.
