Cleveland Police in restraint data breach

The use of restraint data covers the months of April to June, and was published on July 24 on the force’s website, in line with legal requirements. Previous publications of similar data had all personal information redacted. 

But this time, an extra unredacted tab was uploaded in error, which contained the personal information of both those 1,661 members of the public restrained by force and the police officers involved.  

The data did not include home addresses, but divulged names, ethnicity and some health details. 

Cleveland Police did not spot the mistake until September 28 and was alerted to the problem by another force. 

It is trying to contact those whose personal data has been breached. 

“We are required to publish data on officers’ use of force, whether that is a form of restraint, handcuffing, use of Taser or irritant spray,” a Cleveland Police spokesperson said. 

“We have been able to see that the entire spreadsheet has been accessed on a small number of occasions during the time it was in the public domain.” 

“However, as the spreadsheet shows the redacted information first, it’s likely many of these people did not click on the additional data tab at the bottom of the screen.  

“As soon we were made aware of the data breach, steps were taken to remove the information from public view and the breach was referred to the Information Commissioner.  

“An investigation by the Cleveland Police Directorate of Standards and Ethics found that the incident occurred due to human error. Safeguards have been put in place to reduce the risk of a similar incident happening in the future.”  

It has been established that the personal data was seen by around 60 viewers before it was taken down, although the force’s spokesperson said that “some of these were people accessing the data from within criminal justice agencies and other police forces”.