The UK data protection authority (ICO) has issued a compliance notice and a reprimand against the Metropolitan Police Service (MPS) following two unlawful disclosures of personal information.

The authority found that the MPS had not implemented appropriate technical and organizational measures to protect personal information, in violation of the UK Data Protection Act 2018. The investigation revealed widespread weaknesses in the MPS's policies and procedures, as well as serious and persistent deficiencies in data protection training. Consequently, the ICO issued a reprimand to the MPS for the identified failures and a compliance notice ordering it to improve its training, monitoring, and governance arrangements within three and twelve months.

The first failure concerns the communication of unredacted documents to the defendant in a harassment protection order case, revealing the victim's new address and phone number as well as witness contact details. The second relates to the sending of a group email to 18 people in a sensitive investigation, with addresses placed in the "To" field, thus exposing their identities. It was established that the officer responsible for this last sending had not undergone data protection training for over four years. Although the MPS took corrective measures, the ICO deemed them insufficient due to persistently low training rates and technical improvements not yet implemented.