ICO reprimands Staffordshire Police over domestic abuse data breach

The Information Commissioner’s Office (ICO) has reprimanded Staffordshire Police after it disclosed the home address of a domestic abuse victim to their abuser. The incident occurred after the force served the abuser, referred to as “P,” with a Domestic Violence Protection Notice (DVPN) on release from prison to protect the data subject, but P was provided with the victim’s home address—a detail not previously known to P.

The ICO noted that the data subject’s current address was highly sensitive and should have been handled accordingly. The breach was confirmed as a serious data protection failure.

Despite the gravity of the breach, the ICO decided not to issue a fine, citing improvements implemented since the incident. The force has introduced measures intended to reduce the risk of a similar event, including higher training completion rates for data protection and DVPN-related duties, new leadership roles for domestic abuse cases, updated internal procedures, and new technology to assist victims.

Sally-Anne Poole, head of ICO investigations, warned that organisations must get the basics right when handling personal information, especially where there is a known risk to safety. The ICO also reiterated guidance from 2023 on safeguarding PII belonging to domestic abuse victims, highlighting that breaches can put lives at risk and urging organisations to review processes, ensure thorough training, and double-check before transferring or disclosing data.