Staffordshire Police reprimanded by ICO after victim’s address wrongly disclosed to alleged abuser

The incident occurred in March 2024 when Staffordshire Police issued a Domestic Violence Protection Notice (DVPN), an emergency measure intended to protect a victim from violence or threats of violence.

The notice included the victim’s current address when it was served on the alleged perpetrator following their release from prison. The victim’s address was not previously known to the alleged abuser and its inclusion in the notice was not lawful, the ICO said.

It added: “The data breach caused serious distress to the victim, who had previously moved home on several occasions to escape the alleged abuse.”

The ICO’s investigation also found that Staffordshire Police failed to have appropriate measures in place to prevent an unauthorised disclosure, including poor completion rates for mandatory training in both data protection and issuing DVPNs.

Sally-Anne Poole, Head of Investigations at the ICO, said: “Data breaches of this kind are never just technical failures. When someone comes forward as a victim of domestic abuse, they are placing their trust and their safety in the hands of the police.

“What might seem like a simple error, such as including an address in a document that didn’t need it, can expose someone to real and immediate danger. In this case, the very notice designed to protect them instead put them at risk and left them fearing that they would have to relocate their family once again.”

She said Staffordshire Police has since made a number of improvements to reduce the risk of similar incidents happening in the future.

These include increasing completion rates for relevant training, establishing new leadership roles around domestic abuse cases and investing in new technology to help improve services for victims in these cases. Internal procedures have also been updated to ensure that address details are not included in protection notices where they are not already known to the recipient.

Ms Poole added: “This case is a reminder that getting the basics right is not optional. Every organisation must be doing everything necessary to protect the personal information in their care, especially where there is a known risk to someone’s safety.

“Whether in policing, health or local government, we urge organisations to take responsibility for training their staff and putting appropriate systems in place to avoid these incidents and the harm they can cause. We welcome the improvements made by Staffordshire Police to both its policies and procedures.”