UK watchdog issues enforcement notice to London police over two preventable data breaches

The ICO criticised the Metropolitan Police Service for two preventable data protection failures that took place in 2024. In the first case, a man subject to an interim Stalking Protection Order received unredacted witness statements that disclosed a victim’s new phone number, home address and the details of her acquaintances, leading to further contact by the stalker. The second incident involved an email sent without using BCC, revealing the email addresses of 18 people involved in a honey-trap probe related to Parliament.

The regulator noted that these breaches reflected broader shortcomings in the Met’s policies, procedures and staff training, and issued an enforcement notice requiring remedial actions within 12 months. The police force has pledged to achieve full data-protection training compliance and to review its email practices quarterly.