22nd June 2018

The Information Commissioners Office (ICO) has fined Gloucestershire Police £80,000 after a bulk email was sent identifying victims of non-recent child abuse.

On 19 December 2016 an Officer sent an update on the case to 56 recipients by email. The officer entered their email addresses in the “To” field rather than using the “BCC” function which would have prevented their details from being shared with fellow recipients.

It is understood the recipients of the email which potentially included victims, witnesses, Lawyers and Journalists could see the full names and email addresses of all others. Whilst 56 emails were sent, it is understood the email was visible by up to 52 recipients as a result of successful recalls/one email being undeliverable.

Due to the date of the incident the case was dealt with under the provisions and maximum penalties of the Data Protection Act 1998 rather than the recently enacted Data Protection Act 2018. Under the 1998 Act the maximum penalty is £500,000.  Under the Data Protection Act 2018 the maximum penalty for breaches from 25 May 2018 is £17 million pounds or 4% of an organisation’s global turnover.

Some readers will recall the Newcastle City Council data breach which occurred as a result of a bulk email sent 15 June 2017 to 77 recipients disclosing various details of adopting parents and adopted children, home addresses, dates of birth etc. On the face of matters, there appears to have been some inconsistencies in the ICO’s approaches in these two cases. In the Newcastle City Council case the ICO stated because the disclosure was the result of human error they would not take enforcement action. They also appeared satisfied with the Council’s overall information rights practices although scant detail was available to question this position.

In relation to the Newcastle City Council breach our firm is instructed by a group of nearly 90 clients seeking damages from the Council for the distress caused by the data breach and their loss of control of their personal information.

Blog by Richard Hardy, Partner