Staffordshire police were reprimanded by the British authority for illegally disclosing the address of a domestic violence victim to her alleged abuser due to insufficient internal security measures and training.

Facts and context

The British data protection authority, the Information Commissioner's Office (ICO), issued a reprimand decision against Staffordshire police for failures related to the security of personal data.

The case followed the unauthorized disclosure of a domestic violence victim's address to her alleged abuser in March 2024.

Reasons for the decision

The authority identified several breaches:

• Failure to ensure data confidentiality: The authority found that Staffordshire police included the victim's current address in a Domestic Violence Protection Notice (DVPN) given to the alleged abuser upon his release from prison. This address was unknown to him and its inclusion was not legally required, constituting an unauthorized disclosure that exposed the victim to immediate risk and caused her serious distress.
• Failure to implement appropriate security measures: The investigation revealed that the incident was not a simple isolated error but resulted from systemic failures. The authority noted insufficient completion rates for mandatory training on data protection and the issuance of DVPNs, demonstrating a lack of adequate organizational measures to prevent unauthorized disclosure.

Authority's decision

Consequently, the authority issued a reprimand against Staffordshire police.

Lessons learned

This decision reminds that:

• Document templates and default processes must be reviewed to ensure that personal data, such as addresses, are included only when strictly legally necessary.
• The implementation of appropriate security measures necessarily requires effective and monitored staff training, especially when processing sensitive data may expose data subjects to high risks.
• A human double-check procedure before any communication of personal data is a basic indispensable measure, notably to ensure that confidential information has been properly redacted from documents sent to third parties.