Metropolitan Police issued ICO enforcement notice over data breaches

The Information Commissioner’s Office (ICO) has issued an enforcement notice and a reprimand to the Metropolitan Police Service following the erroneous disclosure of sensitive personal information in two separate incidents.

In the first incident, an officer served unredacted documents in a Stalking Protection Order case, exposing a victim’s new address, telephone number, and the contact details of three witnesses. The ICO found that the force failed to ensure confidential information was redacted and noted that relevant officers had not received necessary specialist training.

In the second incident, an officer sent an email regarding a suspect’s bail date to 18 individuals linked to the UK Parliament. By placing the recipients' addresses in the ‘To’ field rather than using appropriate privacy methods, the officer allowed all recipients to see each other’s names and email addresses. The ICO concluded that the Metropolitan Police Service failed to implement adequate technical and organizational measures to protect personal data, violating the Data Protection Act 2018.