Metropolitan Police ordered to improve data protection after stalking and honeytrap breaches

The Metropolitan Police must urgently overhaul its data protection policies after the Information Commissioner’s Office found serious failings in two cases. One involved a stalking victim whose new address and phone number were sent to the defendant by an officer. The other exposed the identities of 18 people linked to Parliament in the Westminster honeytrap investigation.

The ICO issued a reprimand and enforcement notice on 12 September 2024, demanding immediate improvements. Jo Stones, the ICO’s group manager for civil and cyber investigations, said the breaches were foreseeable and preventable. The Met has been given a deadline to implement changes, including updated training and stricter monitoring of compliance.

Stalking victim’s details sent to defendant

In one case, a woman who had already moved home to escape a stalker was forced to relocate again after a Metropolitan Police officer sent her new address and phone number to the defendant. The officer also disclosed the names and contact details of three witnesses in the same document. The defendant later contacted the victim using her new number, confirming he had received the information from police.

The ICO found the officer involved had not completed data protection training for more than four years before the breach. Their manager had also missed required training for a similar period. The Met later issued reminders to staff but the ICO said this was insufficient, calling the force’s policies weak and lacking safeguards.

Honeytrap case email exposed 18 identities

In a separate incident, the Met sent an email to individuals affected by the Westminster honeytrap case, notifying them of a change to the suspect’s bail date. The email failed to use blind carbon copy, meaning all recipients could see each other’s names and email addresses. The ICO said this could allow inferences about highly sensitive connections, even though the email’s content did not explicitly state them.

Eighteen people linked to Parliament were affected. The case centres on allegations that former Conservative MP William Wragg shared politicians’ contact details with someone he met on a dating app. Oliver Steadman, 29, from Islington, faces charges of blackmail and improper use of a public communications network. His trial is scheduled to begin in October 2027.

What happens next

The Metropolitan Police must now comply with the ICO’s enforcement notice, which requires specific improvements to data protection policies, training and monitoring. The force has not yet publicly responded to the reprimand. The ICO will review progress within six months. Residents affected by the breaches were informed by the Met at the time, but the ICO’s action means further safeguards must be put in place.