The Northern Ireland Police Service (PSNI) has been fined nearly £750,000 (approximately €900,150) due to a serious data breach last year that resulted in the release of personal and job-related information of 10,000 officers and staff members on the internet.
While the fine could have potentially reached a hefty £5.6 million (or €6.72 million), the UK Information Commissioner, John Edwards, chose to reduce the total amount in consideration of the PSNI’s current fiscal state and in a bid to avoid redirecting public funds.
Edwards emphasised that the substantial data leak could have been avoided with basic security measures, underlining how important it is to safeguard personal data.
In August 2023, the PSNI accidentally leaked sensitive information – full names, employment specifics – about all active police officers and civilian personnel in response to a Freedom of Information request. This information, subsequently accessed by dissident republicans, prompted concerns for the safety of some officers and staff, particularly those from Catholic communities.
An investigation into the incident by the Information Commissioner’s office (ICO) received statements expressing heightened fear for personal safety. One of the affected individuals articulated their being compelled to seek employment outside the force, resulting in a pay cut and leaving a job they’d sought after from childhood. Furthermore, another individual detailed efforts made to have no online presence and lying about their job upon inquiry, in an effort to stay safe. They reported difficulty sleeping due to the stress imposed on them and their family’s anxiety pertaining to their safety.
“Mr Edwards expressed that the breach, which was preventable and never should have occurred, likely incited terror and uncertainty amongst the PSNI officers and staff. He explained that insufficient internal administrative procedures had led to the exposure of personal details of the entire staff, many of whom had gone to great lengths to hide their employment.
Like-wise, Deputy Chief Constable Chris Todd commented that the penalty was “unfortunate, given the financial limitations we are currently dealing with”. He noted how the PSNI is now in a different position compared to the previous August. The PSNI has strived relentlessly to minimise the significance of the compromised data, introducing multiple measures for the benefit of officers and staff.”