Lancashire Constabulary becomes first police force to receive ICO fine

Lancashire Constabulary has become the first police force to receive a monetary penalty from the Information Commissioner’s Office.

The £70,000 fine was levied after a missing person’s report relating to a 15-year-old girl in foster care was found on a street in Blackpool by a member of the public on 23 July 2011.

An ICO investigation found that the report had been used by an officer trying to locate the girl. It is assumed that he placed the report within his body armour, allowing him to keep his hands free, and that the report fell out into the patrol car unnoticed, where it remained undiscovered for several days.

The report contained information on the youth’s age, address, contact details and sexuality and mentioned that she had previously been raped. It also included personal details on 14 other individuals, including the girl’s attacker.

According to the watchdog, it was believed that the papers fell out of the car when it was used by a different officer attending the scene of an incident. There was no formal requirement for the second officer to check the vehicle.

The report was given to a local newspaper, which wrote an anonymised story – headlined ‘Rape file for all to see’ – about the incident. The story was then picked up by a national newspaper.

It subsequently emerged that Lancashire Constabulary did not keep a record of when sensitive information was taken outside of the police station.

The force did not provide secure bags for storing personal information and officers were not given specific training on how to look after hard copy documents outside the station.

Steve Eckersley, the ICO’s Head of Enforcement said: “The fact that information as sensitive as this could go missing without anybody realising is extremely worrying, and shows that Lancashire Constabulary failed to have the necessary governance, policies and suitable training in place to keep the personal information they handle secure.

“The loss of this information and the news that it had been leaked to a local newspaper is likely to have been extremely distressing for all involved.”

Eckersley said it was “vitally important” that police forces had effective data protection policies in place for electronic and paper based systems. This would include keeping a record of where personal information is being stored and used, he said.

Lancashire Constabulary has given an undertaking which commits it to taking action on keeping personal information secure.

The force is to put in place a written policy place detailing employees’ specific responsibilities when removing personal data from the station, as well as its subsequent use, protection and return. It will also provide staff training.

Until now the vast majority of ICO monetary penalties have been levied on local authorities. The watchdog has now handed down more than £1m in fines on councils since it received enhanced powers in April 2010. The payments go to the Treasury’s Consolidated Fund.

The largest fine to date (£140,000) was imposed on Midlothian Council in January this year after the authority disclosed sensitive personal data relating to children and their carers to the wrong recipients on five separate occasions.