ICO Reprimands Staffordshire Police After Domestic Abuse Breach

A UK police force committed a serious breach of data protection law after sharing the address of a domestic abuse victim with their abuser, the Information Commissioner’s Office (ICO) has revealed.

The privacy regulator issued a reprimand to Staffordshire Police on October 28, following the incident in March 2024.

The force had served the abuser, “P,” a Domestic Violence Protection Notice (DVPN) on their release from prison in order to protect the abuse victim, or “data subject.”

However, it erroneously included that person’s address, which was not previously known to P.

“As a consequence of the investigation into the relevant incident the commission has become aware of allegations that P subjected the data subject to both physical and emotional abuse over a period of several years, resulting in the data subject having to relocate their address on numerous occasions in order to escape the alleged abuse,” the reprimand noted.

“In this context, the data subject’s current address was highly sensitive information and should have been handled as such.”

Despite the serious nature of the breach, the ICO decided not to fine the police force, even though the regulator found that it failed to put in place “appropriate measures” to prevent the disclosure, “including poor completion rates for mandatory training in both data protection and issuing DVPNs.”

It argued that Staffordshire Police had since made improvements to reduce the risk of a similar event taking place in the future. These included increased training completion rates, new leadership roles for domestic abuse cases, new internal procedures and new technology to improve services for victims.

ICO head of investigations, Sally-Anne Poole, said the case is a reminder of the importance of getting the basics right.

“Every organization must be doing everything necessary to protect the personal information in their care, especially where there is a known risk to someone's safety,” she added. “Whether in policing, health or local government, we urge organizations to take responsibility for training their staff and putting appropriate systems in place to avoid these incidents and the harm they can cause.”

Advice for Handling Sensitive Information

The ICO warned back in 2023 that organizations handling the personally identifiable information (PII) of domestic abuse victims could put lives at risk if breaches occur.

It said at the time that it had issued reprimands to seven organizations in the 14 months after sensitive PII was breached, including one police force.

The latest revelations will do little to allay concerns that the regulator’s public sector approach – which favors warnings, reprimands and enforcement notices over fines – is not having the desired effect.

After this latest incident the ICO advised organizations handling sensitive PII to:

Ensure staff know how to handle the PII of people experiencing domestic abuse with extra care

Review default templates and processes to ensure PII is only included where legally necessary

Regularly check information to avoid disclosing information to an old address, email or phone number

Always double check before any PII is transferred, altered or disclosed

Ensure training is thorough, relevant and tailored to the tasks staff actually carry out