A police force mistakenly included a victim's home address in a notice served to an abuser. This error led to a reprimand from the Information Commissioner's Office (ICO) to Staffordshire Police on October 28, following the incident in March 2024. The critical takeaway isn't just the mistake itself, but that it stemmed from controls that should have already been in place.
What Happened and What the Data Shows
Staffordshire Police issued a Domestic Violence Protection Notice (DVPN) to an individual referred to as "P" upon their release from prison. Unfortunately, the notice included the victim's home address. The ICO highlighted that P had allegedly abused the victim over several years, forcing them to relocate multiple times. In this context, the victim's address was highly sensitive and needed careful handling.
The ICO found that Staffordshire Police failed to implement adequate measures to prevent this disclosure. Key issues included low completion rates for mandatory training in data protection and issuing DVPNs. Although no fine was imposed, improvements were noted: increased training completion, new leadership roles for domestic abuse cases, updated procedures, and enhanced technology for victim services.
Key Findings
1. Training Needs to Be Completed, Not Just Designed. The ICO's concern was about training completion rates, not the absence of a program. Mandatory training existed but wasn't completed. For a Data Protection Officer (DPO), this highlights a gap: a control that isn't enforced can't be considered effective. Article 32(1) requires appropriate technical and organizational measures, and incomplete training doesn't meet this standard.
2. Task-Specific Training Is Essential. The ICO pointed out gaps in training specific to issuing DVPNs, alongside general data protection training. Generic modules don't address the specific risks when staff fill out notice templates. The risk is at the task level.
3. Templates and Defaults Can Be Risky. The ICO advises reviewing templates and processes to ensure personal data is included only when legally necessary. This aligns with data minimization under Article 5(1)(c). If a template includes fields that shouldn't be shared, it relies on individual vigilance rather than design.
4. Organizational Changes, Not Just Technical Fixes, Are Needed. The response included new leadership roles for domestic abuse cases, alongside procedures and technology. Accountability is crucial. Naming someone responsible for high-risk processing changes how training, review, and escalation are managed.
5. The ICO's Approach to Public Sector Bodies Is Under Review. The ICO often opts for warnings and reprimands over fines for public bodies. In 2023, it issued reprimands to seven organizations after sensitive data breaches, including one police force. Repeated reprimands in the same area raise questions about deterrence. A reprimand is public, citable, and outlines what the ICO expected to be in place.
What This Means for Your Team
This pattern is relevant beyond policing. Any organization holding data where disclosure poses physical risks faces similar challenges: high-severity outcomes, routine administrative steps, and controls dependent on human attention. Consider refuges, housing providers, health services, local authorities, family law practices, and HR teams handling harassment cases.
The reprimand also illustrates how a supervisory authority evaluates incidents. It examines what was mandated, whether it was followed, if the process was designed to prevent errors, and what changes were made afterward. These four questions provide a ready-made audit framework.
On leadership: the new domestic abuse leadership roles suggest that accountability led to improvement. If your high-risk processing lacks a named senior owner, that's a governance gap you can address before an incident occurs.
Action Items by Priority
Do First
- Identify Your "Address-Equivalent" Data. List data points whose disclosure could endanger someone. Flag them in your records of processing and handling procedures.
- Pull Training Completion Data for High-Risk Roles. Focus on completion rates for teams handling sensitive disclosures, and address gaps with their managers.
- Add a Pre-Disclosure Check. The ICO advises double-checking before personal data is transferred, altered, or disclosed. Make this a documented step for notices, letters, and emails sent to third parties.
Do Next
- Audit Templates and Defaults. Remove unnecessary fields. If a field is needed for some recipients but not others, create separate templates instead of relying on manual deletion.
- Tailor Training to the Task. Ensure training is thorough, relevant, and task-specific. Include scenario-based content for documents your staff produce.
- Verify Contact Details Regularly. Check addresses, emails, and phone numbers to avoid disclosing to outdated contacts.
Do Within the Quarter
- Assign Senior Ownership for High-Risk Processing. Name an accountable lead and ensure your DPO has a direct line to them.
- Test the Effectiveness of Your Controls. If training is mandatory, determine what happens if it's not completed. Use access restrictions and manager escalation rather than reminders.
- Rehearse a Breach Response for Sensitive Data. A breach involving a victim's address may require urgent protective action. Decide in advance who contacts whom.
