UK data watchdog criticizes Metropolitan Police for data handling failures

The UK's data protection regulator criticized the Metropolitan Police Service (MPS) for significant data handling failures, including sharing a stalking victim's new contact details with her abuser and a separate incident exposing the email addresses of 18 individuals connected to Parliament. The Information Commissioner's Office (ICO) issued the MPS with an enforcement notice and a reprimand over the two incidents, which occurred in 2024, based on information published by The Register.

The ICO's enforcement notice and reprimand highlight two major incidents and broader systemic weaknesses within the MPS. The first involved officers providing a stalker, subject to an interim Stalking Protection Order, with unredacted documents that revealed the victim's new phone number and home address, leading to her being contacted by the perpetrator. The second incident was a "CC-not-BCC" email blunder where the MPS inadvertently exposed the email addresses of 18 individuals targeted in a honeytrap operation to each other. The ICO found that data protection training completion rates were low across the force, with the officer involved in the email breach having not completed training for over four years. The MPS has committed to improving training compliance and reviewing email practices, with the ICO emphasizing the need for effective safeguards, training, and assurance for organizations handling sensitive information, especially in the public sector.

Source: The Register