Met Police reprimanded after stalking victim’s details sent to defendant

The Metropolitan Police has been ordered to overhaul its data protection policies after two serious breaches exposed sensitive information. The Information Commissioner’s Office issued a formal reprimand and enforcement notice on 12 September 2024, calling the force’s safeguards inadequate.

In one case, a woman who had obtained a stalking protection order was forced to relocate after a Met officer sent her new address and phone number to the defendant. The officer also disclosed the contact details of three witnesses in the same document.

Victim contacted after details leaked

The victim later received a message from the defendant, who said he had obtained her updated contact information from police documents. The breach occurred during the handling of a stalking protection order case, as reported by the BBC.

The second breach involved an email sent to 18 individuals connected to Parliament. The message, which notified recipients of a change to a suspect’s bail date in the Westminster ‘honeytrap’ case, revealed the names and email addresses of everyone copied in.

ICO demands urgent action

The Information Commissioner’s Office said the breaches were preventable and highlighted systemic weaknesses in the Met’s data protection measures. Jo Stones, a spokesperson for the ICO, said public sector organisations handling sensitive information must enforce training and monitoring.

The ICO found that the officer responsible for the email breach had not completed data protection training for more than four years. Their manager had also missed required training for a similar period. The watchdog said the Met’s policies were weak and lacked proper oversight.

Met acknowledges failings

A Metropolitan Police spokesperson said the force had reported the breaches to the ICO as soon as they were discovered and had apologised to those affected. The statement acknowledged the real consequences for victims and said steps had been taken to strengthen disclosure processes.

The Met said it had sent reminders to staff and implemented additional safeguards, though the ICO concluded these measures were insufficient. The enforcement notice requires the force to demonstrate improvements within three months.

What happens next

The Metropolitan Police must submit evidence to the ICO by 12 December 2024 showing how it has addressed the identified weaknesses. The watchdog will review the response and could take further action if the changes are deemed inadequate.

Residents affected by the breaches have been advised to contact the Met’s Professional Standards Unit for further information. The ICO has not disclosed whether the victims will receive compensation.