Met Police potentially breaching 30,000 individuals’ data

The Metropolitan Police are being questioned for potentially breaching the personal data of approximately 30,000 firearm owners.

It transpires that the London Metropolitan Police have reportedly disclosed the names and addresses of 30,000 firearm and shotgun owners (around 5,000 rifle owners and 25,000 shotgun owners) to a direct mail marketing agency, named Yes Direct Mail, which is said to be as part of an advertising campaign.

In the absence of specific permissions, any handover of information can be construed as a breach of data law.

Does the Metropolitan Police have a justifiable reason for disclosing data?

Questions of a data breach were imminently highlighted. In accordance with the Firearms Form 201, it notes that:

Although the consent form allows an individuals’ data to be shared with their GP, other government departments, regulatory bodies, or enforcement agencies, that doesn’t necessarily give permission for the Metropolitan Police to forward their information onto other companies; let alone a marketing company.

On the face of things, it doesn’t seem like the Police force have a justified defence for disclosing 30,000 individuals’ data. Under the Data Protection Act (DPA) 1998, data controllers can only use the defence of necessity if there’s a legitimate reason for processing data in such a way as the Metropolitan Police have done so.

How were the owners notified?

The owners were notified of the data handover after they received a leaflet on the 18^th April 2017. The leaflet, titled “Protect your firearms and shotguns with Smartwater”, was advising owners to “buy a firearms protection pack at a reduced price” of £8.95.

Owners quickly associated the data breach to the Metropolitan Police as the leaflet featured their logo.

It remains a mystery as to why the Metropolitan Police felt the need for firearms and shotguns to require extra ‘marking’ as it seems to be highly controlled with serial numbers on the firearms and shotguns. Forensic scientists are able to read serial numbers that have been filed-off or altered; these are common tricks that criminals use to discreetly acquire guns.

Perhaps it was for financial reason by way of a referral fee…

Although there are suspicions as to why the Metropolitan Police would want to endorse the Smartwater product, it’s questionable as to why they would directly supply personal details of tens of thousands of individuals for marketing purposes.

The Register reports that this is the first time that the Metropolitan Police has supplied personal details from its databases.

Investigations

The Information Commissioner’s Office reiterated:

“…businesses and organisation are required under the DPA to keep people’s personal data safe and secure. If people have concerns about the way an organisation is handling their personal data, they can report them to us.”

The British Association for Shooting and Conservation (BASC) confirmed that the Metropolitan Police are investigating the matter and can’t provide commentary until their investigations have been finalised.

Exam Board, AQA, reportedly compromised 64,000 examiners’ personal details

Data of 100,000 U.S. Student loan applicants hacked