Gloucestershire police could face significant legal claims following data breach

A leading data protection lawyer has said that the data breach by Gloucestershire Police, which resulted in the identities of alleged victims of historical child abuse being mistakenly revealed, could result in significant claims for compensation by those affected.

This follows an incident on 19th December 2016 when a Police Officer at Gloucestershire Police sent an update on an investigation into alleged child abuse involving multiple victims to 56 recipients by way of a group email.

The email was sent to each of the recipients, rather than the recipients being blind copied into the email, as seems to have been intended. As a consequence, all of recipients could view the email addresses and full names of all of the other recipients.

Given the nature of the email, it could be reasonably inferred that many of the recipients were, or were associated with, alleged victims of child abuse.

Following their investigation of the incident, the Information Commissioner’s Office (ICO) found that the Police’s use of bulk emails to send such confidential and sensitive personal information represented a failure to use appropriate technical measures to hold personal information securely and was therefore a breach of the Data Protection Act.

The ICO found that the data breach was likely to have caused substantial distress to the alleged abuse victims, some of whose right to anonymity for life has been removed by the incident.

The ICO also stressed that there was no guarantee that the information has been recovered in full and may have been disclosed more widely and that this concern would have caused further distress. As a result the ICO fined Gloucestershire Police £80,000.

Sean Humber, head of the Information Law Team at law firm Leigh Day, who has acted in a succession of claims for compensation relating to the unauthorised disclosure of personal information over the last 20 years, said:

“As a result of the ICO’s damning findings, as well as successful claims in other cases following similar breaches, it seems clear that those affected have very strong claims for compensation against Gloucestershire Police for breach of the Data Protection Act and the misuse of their personal information.

“In light of the extremely sensitive nature of the personal information mistakenly disclosed, the vulnerability of many of those affected and the continuing uncertainty about what has happened to the information, I would expect the levels of compensation awarded to affected individuals to be significant.”