South Yorkshire Police reprimanded by ICO following deletion of BWV evidence

Its investigation found SYP did not have the appropriate technical and organisational measures in place to keep the evidence secure, including:

• Delaying the formulation of IT backup policies and not escalating to senior management when flaws were discovered in 2019;
• Poor record keeping, meaning it could not confirm how many pieces of footage were permanently lost; and
• Not identifying the security risk in relation to transferring of personal data between IT systems.

Sally Anne Poole, head of Investigations said: “This incident highlights the importance of having detailed policies and procedures in place to mitigate against the loss of evidence.

“People rightly have high expectations that our police forces and services, which protect us, also protect the personal information they hold.

“There is a lot to be learned from this incident and I encourage police forces and services and other organisation using this type of technology to check and make improvements where they find potential flaws.”

The ICO said at the end of each shift, officers’ BWV footage was uploaded and stored to a central hub which could be accessed and managed, along with all of SYP’s digital evidence, via a secure system.

Following an upgrade in May 2023, the secure system began to struggle processing BWV data and a local drive workaround was put in place.

In August 2023, SYP identified that its BWV file storage was very low and further investigation found that 96,174 pieces of original footage had been deleted from its system.

The following month it was found the deletion had taken place on July 26, 2023, and included the loss of data relating to 126 criminal cases, [however] only three of the cases were impacted by the loss, the ICO said.

It added: “Of those three cases, SYP states one may have progressed to the first court hearing if BWV had been available. However, as there was no additional independent evidence to prove the offence, progression to prosecution stage was already uncertain.

“Prior to the deletion, 95,033 pieces of BWV footage had been copied to a new system that SYP was implementing but, due to poor record keeping, SYP remain unable to confirm the exact number of files deleted without copies made.”

The ICO has set  out a number of actions it recommends SYP takes:

• Ensure there is an adequate storage backup solution and process to restore lost BWV footage;
• Continue to shadow third parties when accessing SYP IT systems;
• Define third party roles and responsibilities when processing personal information held on SYP IT systems;
• Complete a risk assessment to determine security implications and control requirements prior to permitting third party access to SYP IT systems: and
• Ensure all records are marked in a clear, identifiable way.

“These should also act as prompts to all police forces and services who use BWV to check and improve, where necessary, data protection practices,” the ICO said.