ICO Reprimands Staffordshire Police for Disclosing Domestic Abuse Victim's Address to Abuser
The UK Information Commissioner's Office (ICO) issued a reprimand to Staffordshire Police on October 28, 2026, over a March 2024 breach of data protection law. The force served a Domestic Violence Protection Notice (DVPN) on an abuser ("P") on release from prison and mistakenly included the victim's home address, which P did not previously know. The ICO noted allegations of years of physical and emotional abuse that had forced the victim to move home repeatedly. The ICO did not fine the force, citing improvements made since the incident.
Detalhes técnicos
- The breach was a human and process error, not a cyberattack: the address was disclosed in a DVPN document.
- The ICO found the force failed to put in place "appropriate measures", including poor completion rates for mandatory training in data protection and in issuing DVPNs.
- Subsequent improvements: higher training completion rates, new leadership roles for domestic abuse cases, new internal procedures and new technology to improve services for victims.
- The ICO warned in 2023 that breaches of domestic abuse victims' PII could put lives at risk. It had issued reprimands to seven organizations in the preceding 14 months, including one police force.
Remediação
The ICO advises organizations handling sensitive PII to:
- Ensure staff handle the PII of people experiencing domestic abuse with extra care.
- Review default templates and processes so PII is included only where legally necessary.
- Regularly check contact information to avoid disclosure to an old address, email or phone number.
- Double check before any PII is transferred, altered or disclosed.
- Make training thorough, relevant and tailored to the tasks staff actually perform.
Linha do tempo
-
ICO Reprimands Staffordshire Police for Disclosing Domestic Abuse Victim's Address to Abuser
ler a análise desta fonte ocultar
The UK Information Commissioner's Office (ICO) issued a reprimand to Staffordshire Police on October 28, 2026, over a March 2024 breach of data protection law. The force served a Domestic Violence Protection Notice (DVPN) on an abuser ("P") on release from prison and mistakenly included the victim's home address, which P did not previously know. The ICO noted allegations of years of physical and emotional abuse that had forced the victim to move home repeatedly. The ICO did not fine the force, citing improvements made since the incident.
Technical Details
- The breach was a human and process error, not a cyberattack: the address was disclosed in a DVPN document.
- The ICO found the force failed to put in place "appropriate measures", including poor completion rates for mandatory training in data protection and in issuing DVPNs.
- Subsequent improvements: higher training completion rates, new leadership roles for domestic abuse cases, new internal procedures and new technology to improve services for victims.
- The ICO warned in 2023 that breaches of domestic abuse victims' PII could put lives at risk. It had issued reprimands to seven organizations in the preceding 14 months, including one police force.
Remediation
The ICO advises organizations handling sensitive PII to:
- Ensure staff handle the PII of people experiencing domestic abuse with extra care.
- Review default templates and processes so PII is included only where legally necessary.
- Regularly check contact information to avoid disclosure to an old address, email or phone number.
- Double check before any PII is transferred, altered or disclosed.
- Make training thorough, relevant and tailored to the tasks staff actually perform.