ICO fine Kent Police £80K for serious data breach of alleged domestic abuse victim

The Information Commissioners Office (ICO) has fined Kent Police £80,000 after the entire contents of an alleged domestic abuse victim’s mobile phone were disclosed to the alleged assailant.

The victim had given her phone to Kent Police on the grounds it contained video footage of the alleged abuse. The contents were copied, but the domestic abuse court case was discontinued.

Her former partner who was accused of the abuse was actually a serving officer at Kent Police and faced separate misconduct proceedings, and as part of the separate case, the entire contents of the phone were then inadvertently disclosed to the solicitor defending the officer.

A serious breach

Although some data on the phone may initially have been required for disclosure as part of the original complaint, the entire contents of the phone was accidentally disclosed to the defence solicitor during the separate misconduct proceedings, and the solicitor then disclosed it to their client, who was the alleged assailant in the discontinued domestic abuse case.

The phone contained over 13,000 files and included information about their divorce as well as intimate images, texts, and a huge amount of personal and sensitive information. The defence solicitor then refused to return the data on the grounds it contained evidence that was useful for the defence.

Disclosure was “not lawful or necessary”

The ICO in their investigation recognised that the disclosure of the data was not lawful or necessary.

The person who disclosed the data was a hearings manager who was found to be unable to distinguish between what should be disclosed and what should be withheld. As such, they have are not being blamed as it is Kent Police who have failed to take appropriate steps.

A “serious oversight”

The breach has been described by investigators as a “serious oversight” given the volume of the data and the very personal and sensitive nature of the data disclosed. The police are used to handling data from phones in criminal matters, especially for witnesses, and therefore ought to have had solid steps in place to prevent someone from inadvertently disclosing such information to someone else.

We have, and do, act for individuals who have been subject to similar breaches by public organisations, including the police, and the weight of the fine (£80,000) is of no surprise to us. We know all too well just how badly the victims can be affected by these sorts of breaches, and it’s why the law recognises they are entitled to claim for compensation.

Health and Social Care Information Centre signs ICO undertaking after failing to protect against medial data sharing

Data Protection Compensation Claims on a No Win, No Fee