The data privacy watchdog the ICO has reprimanded the Metropolitan Police after personal information in two highly sensitive cases was erroneously disclosed.
An officer served unredacted documents to a defendant in a Stalking Protection Order (SPO) case. The documents included the victimโs new address and telephone number, besides the names and contact details of three witnesses. The victim had changed her address and phone number because of the risks she faced. The defendant later contacted the victim on her new number and said he had received documents containing her new contact details from the Met. The ICO found the Met failed to ensure confidential third-party information was redacted before documents were served; and that relevant officers had not received the required specialist SPO training at the time, and that the process for preparing and quality assuring documents was inadequate.
And in a case of people linked to the UK parliament targeted by someone via WhatsApp messages in 2024 and 2025, in an attempt to gather compromising information, a Met officer emailed all the people affected to advise them of a change to the suspectโs bail date. The recipientsโ email addresses were placed in the โToโ field, meaning all recipients could see each otherโs email addresses and names. The context of the email meant that highly sensitive information could potentially be inferred about the recipients, even though the body of the email did not explicitly contain that information. Theย Met confirmed that 18 people linked to the UK Parliament were affected. The watchdog concluded that the Met should have used more appropriate methods to communicate with the affected people and not relied on sending one bulk email.
These were not isolated mistakes, the ICO added; but reflected wider weaknesses in Met policies, procedures and assurance. Jo Stones, ICO Group manager โ Civil and Cyber Investigations, said: โPeople entrust the police with some of their most sensitive personal information, often at moments when they are vulnerable or at risk. They have the right to expect that information will be handled securely.ย In these cases, the Metropolitan Police Service failed to put in place the safeguards needed to protect peopleโs personal information. One breach exposed a stalking victimโs new contact details to the person she needed protection from. Another revealed the identities of people connected to a highly sensitive investigation.
โThese incidents were foreseeable and preventable. Our action makes clear that organisations, particularly those in the public sector handling sensitive law enforcement information, must have effective training, monitoring and assurance in place. Policies and reminders are not enough if they are not followed, checked and enforced.โ
What next
The Met among other things in response issued a force-wide reminder about mandatory information security training, and introduced a behavioural alert tool to prompt staff when emails are being sent to multiple external recipients. However the ICO considered further action was still needed. Met training completion rates remained low, the watchdog said. The ICO issued anย enforcement notice to Met Commissioner Sir Mark Rowley,ย requiring the Met to take steps within three and 12 months to improve its data protection training compliance, monitoring and governance.
Comment
Graeme Stewart, head of public sector at the software firm Check Point, called the case a stark reminder that data protection failures aren’t just IT problems; they’re people and process problems. He said: “The Met’s breaches didn’t stem from a sophisticated cyberattack; they came from unredacted documents and a bulk email sent to the wrong field. That’s exactly the kind of everyday human error that robust training, checks and monitoring are designed to catch. What’s particularly concerning is the ICO’s finding that training completion rates remained low, and that the officer and manager involved in one incident hadn’t completed mandatory data protection training in over four years. In a public sector organisation handling some of the most sensitive personal data in the country, details of stalking victims, witnesses, people under investigation, that’s a significant gap in basic cyber hygiene.”
Photo by Mark Rowe: Police patrol, Covent Garden.
