Northern Ireland police fined for data breach exposing secret identities of officers

The Police Service of Northern Ireland (PSNI) has been fined £750,000 ($1 million) by the United Kingdom’s data protection regulator after accidentally revealing the identities of all of its officers and staff, potentially exposing them to terrorist and criminal groups and “leaving many fearing for their safety.”

It is one of the only monetary penalties that the Information Commissioner’s Office (ICO) has issued against a publicly funded organization over the past two years. According to the ICO, the fine would have been £5.6 million ($7.4 million) were it not for this policy.

John Edwards, the Information Commissioner, said: “I cannot think of a clearer example to prove how critical it is to keep personal information safe. It is impossible to imagine the fear and uncertainty this breach – which should never have happened – caused PSNI officers and staff.

“A lack of simple internal administration procedures resulted in the personal details of an entire workforce – many of whom had made great sacrifices to conceal their employment – being exposed,” said Edwards.

The data was exposed when the PSNI responded to a request under the Freedom of Information Act — uploaded to a public portal — with a document that accidentally included a worksheet from the force's human resources management system.

It included surnames and first name initials, job role, rank, grade, department, location of post, contract type, gender and PSNI service and staff number.

After being alerted to the breach, the PSNI quickly announced they were “working on the assumption that the file was in the hands of dissident republicans and that it would be used to create fear and uncertainty and for intimidation.”

Testimonies by those impacted, shared by the ICO, include police officers and staff expressing concern about their own safety and that of their families.

The sensitivity of the 9,483 officers and staff from the PSNI impacted by the incident trace back to the deaths of more than 300 police officers during the Troubles in Northern Ireland between the late 1960s and 1998.

The legacy of that period continues, with several paramilitary and criminal groups remaining active in their targeting of police. Last year a senior PSNI detective, John Caldwell, was shot multiple times after coaching an under-15s soccer team at a sports center.

“How has this impacted on me? I don’t sleep at night. I continually get up through the night when I hear a noise outside to check that everything is ok. I have spent over £1000 installing modern CCTV and lighting around my home, because of the exposure,” said one of the anonymous data subjects.

Another said: “I have gone to great trouble to ensure that I have remained invisible, with no social media presence, removal from the electoral roll, 192.com, never revealing my job to others and lying about where I work whenever asked. … I have trouble sleeping, my children … are all stressed about my welfare, some of them have told me that they have nightmares about me getting attacked.”