Police force unlawfully disclosed home address of domestic abuse victim to alleged abuser, ICO finds

Issuing the police force with a reprimand, the ICO found the data breach caused “serious distress” to the victim, who had previously moved home on several occasions to escape the alleged abuse.

The incident occurred in March 2024 when Staffordshire Police issued a Domestic Violence Protection Notice (DVPN), an emergency measure intended to protect a victim from violence or threats of violence.

The notice included the victim’s current address when it was served on the alleged perpetrator following their release from prison.

The victim’s address was not previously known to the alleged abuser and its inclusion in the notice was not lawful, the ICO found.

Meanwhile, the investigation found that Staffordshire Police failed to have appropriate measures in place to prevent an unauthorised disclosure, including poor completion rates for mandatory training in both data protection and issuing DVPNs.

In light of its findings, the ICO issued the following advice for organisations handling sensitive personal information:

• Make sure relevant staff know how to handle the personal information of people experiencing domestic abuse with extra care and are able to accommodate any requests for privacy or security.
• Review default templates and processes to ensure personal information, such as addresses, is only included where it is legally necessary.
• Regularly check contact information, by confirming with people that their details are still accurate to avoid disclosing information to an old address, email or phone number.
• Always double-check before any personal information is transferred, altered or disclosed - for example confirming an address has been redacted, an email address is correct, or all recipients are authorised to receive it.
• Ensure training is thorough and relevant by making it role-specific and tailored to the tasks staff actually carry out, so they feel confident handling personal data safely and securely.

According to the watchdog, Staffordshire Police has since made a number of improvements to reduce the risk of similar incidents happening in the future.

These include increasing completion rates for relevant training, establishing new leadership roles around domestic abuse cases and investing in new technology to help improve services for victims in these cases.

Internal procedures at the police force have also been updated to ensure that address details are not included in protection notices where they are not already known to the recipient.

Sally-Anne Poole, Head of Investigations at the ICO, said: "Data breaches of this kind are never just technical failures. When someone comes forward as a victim of domestic abuse, they are placing their trust and their safety in the hands of the police. What might seem like a simple error, such as including an address in a document that didn't need it, can expose someone to real and immediate danger. In this case, the very notice designed to protect them instead put them at risk and left them fearing that they would have to relocate their family once again.”

She added: “This case is a reminder that getting the basics right is not optional. Every organisation must be doing everything necessary to protect the personal information in their care, especially where there is a known risk to someone's safety. Whether in policing, health or local government, we urge organisations to take responsibility for training their staff and putting appropriate systems in place to avoid these incidents and the harm they can cause. We welcome the improvements made by Staffordshire Police to both its policies and procedures.”

Staffordshire Police's Deputy Chief Constable Caroline Marsh said: "We fully recognise the impact this incident had on the victim and sincerely regret the distress and disruption this caused. We remain committed to learning from this case. 

"[…] Over the last 18 months, we have strengthened leadership and governance arrangements through the introduction of dedicated strategic and tactical domestic abuse leads, alongside a dedicated domestic abuse chief inspector role for 12 months to drive improvement, oversight and accountability.

"We have enhanced our approach to risk assessment through the introduction of a new Domestic Abuse Risk Assessment (DARA) process.”

She added: "We continue to invest heavily in officer training and awareness to ensure our workforce understands the complexities of domestic abuse, coercive and controlling behaviour, vulnerability and victim safeguarding. Additional learning from this incident will be incorporated into future vulnerability training to reinforce the importance of protecting sensitive information and understanding the potential impact that disclosure can have on victim confidence and safety.

"We have also increased scrutiny of Domestic Violence Protection Notice applications, with strengthened supervisory oversight.

"These improvements are already delivering positive outcomes, with conversion rates from Domestic Violence Protection Notices to Orders increasing significantly, demonstrating improved quality and effectiveness in our safeguarding activity.”

Lottie Winson