Police and Criminal Justice Data Breach Claims.

It is the job of the police to protect us, and in a digital society that also means protecting our data. However, all too often our trust in those in authority who have access to our personal information is being undermined. Where a breach occurs, the ICO can respond with actions such as financial penalties and prosecutions.

Some examples of cases investigated by the ICO include where:

• Gloucestershire Police was fined for revealing identities of abuse victims in bulk email
• The Crown Prosecution Service (CPS) was fined £325,000 after they lost unencrypted DVDs containing recordings of police interviews
• Greater Manchester Police was fined £150,000 after three DVDs containing footage of interviews with victims of violent or sexual crimes got lost in the post
• Dyfed-Powys Police was fined after an email, including information that could be used to identify eight sex offenders, was sent to a member of the public in error
• Kent Police was fined after sensitive personal details of a woman who accused her partner of domestic abuse were passed to the suspect
• Scotland Yard breached data protection laws to spy on one of its officers while she was on sick leave
• The Ministry of Justice was fined £180,000 for “serious failings” in the handling of confidential data following the loss of a hard drive containing the details of almost 3,000 prisoners at Erlestoke prison in Wiltshire.

Dealing with many different types of police and criminal justice data breach cases, one thing that has become apparent to our solicitors is that the full impact is often not felt until months after the initial violation.

In particular, where personal records are accessed, we’ve seen cases where experiencing a data breach has resulted in adverse life events such as having to move house or area, losing a job, relationship stress and separation, and dislocation from friends and family. All of which can lead to a diagnosable psychological injury. And this is often happening months after the initial breach was revealed.

Crucially, in most cases, these data breaches aren’t caused by scammers trying to hack our government, but by simple human errors.

Cybercriminals are becoming more and more sophisticated. But this doesn’t let the police and criminal justice bodies organisations off the hook. If they have done everything in their power to protect your data and have robust security processes and procedures in place, it is unlikely that a claim would be successful. This is why we usually wait for the results of an investigation by the ICO before starting a claim.

But, in most cases, police and criminal justice data breaches happen because of human error and/or a failure to implement reasonable and robust processes. So claiming compensation isn’t just in your best interests – it is the only way these bodies will be persuaded to take their responsibilities seriously and make the necessary improvements.