PSNI data breach fine highlights privacy harms 

The ICO have issued a £750,000 fine to the Police Service of Northern Ireland (PSNI) for exposing the personal information of its whole workforce. The penalty notice highlights the importance of implementing appropriate technical and organisational measures (TOMs) in data practices, to ensure that information remains secure. In this article, we outline the facts of the incident, the factors considered by the Information Commissioner in determining the fine value, and compliance mechanisms that organisations can implement to prevent a breach of this nature in the future. 

The breach 

As outlined in our previous article, PSNI received two Freedom of Information (FOI) requests from an individual in quick succession, through the third party WhatDoTheyKnow (WDTK), requesting “the number of officers at each rank and number of staff at each grade” and “how many are substantive / temporary / acting …”. In exercising these requests as one, PSNI staff downloaded the information as a Microsoft Excel file export from PSNI’s human resources management system, to form a worksheet containing subjects’: surnames and first name initials, job role, rank, grade, department, location of post, contract type, gender and PSNI service and staff number. 

Whilst reviewing the information prior to disclosure, multiple worksheets were created within the same document for editing purposes, as a standard practice for such requests. However, in finalising the document for disclosure, including quality assurance checks, the original worksheet was not removed and thus unredacted information was disclosed. This information was promptly uploaded to WDTK’s website, following their “mostly automatic” process with minimal review processes prior to publication, given the public information nature of their service offering. 

Within two hours of the file being made public via the WDTK website, PSNI was notified of the breach by its officers. PSNI promptly informed WDTK, who hid the upload from public view approximately 140 minutes after the published time and deleted the file from their website within 40 further minutes.  

The assessment 

Several factors were listed by the Commissioner in determining the penalty, following their investigation, the most prominent of which is the non-material damage caused as a direct result of the breach. Paragraph 113 of the penalty notice provides that this includes: 

1. Significant psychological harm (fear and anxiety about personal safety and the safety of family and friends)
2. Loss of control of personal data (diminished ability to control knowledge of occupation)

A snippet of firsthand accounts correspondingly includes: 

• “I have trouble sleeping, my children… are all stressed about my welfare, some of them have told me that they have nightmares about me getting attacked.” 

• “The risk to my personal security and the safety of my wife and… young children is more significant for me due to the fact that I grew up in the area where we are most active… I have gone to great lengths to keep my occupation confidential.” 

The latter comment sheds light on the significant contextual factors surrounding PSNI data, set out in paragraphs 54 to 64. PSNI confirmed that the information had been accessed by dissident republicans, at a time when the terrorism threat level in Northern Ireland had already been raised to severe. On this basis, the gravity of the integrity and confidentiality principle, and Article 32 UK GDPR, infringement was deemed to be serious and thus subject to the maximum fine under Article 83(5)(a). Paragraph 76 of the penalty notice simply states “the severity of the risk is self-evident”. 

Actions taken by PSNI to mitigate the damage suffered by the data subjects were noted as: 

• Prompt removal of the material from the WDTK website 

• PSNI’s criminal investigation

• Steps taken to reduce the identifiability of PSNI officers and staff

• Support offered to PSNI staff

However, these actions were deemed a reasonable expectation and not a mitigating factor. Conversely, the Commissioner determined that PSNI carried the full degree of responsibility for the incident, which was considered an aggravating factor. 

Outcome 

Following their assessment, the Commissioner decided to impose the penalty of a fine, noting the incident as “sufficiently egregious”. As such, the starting point under Article 83(5)(a) UK GDPR for an infringement of Article 5(1)(f) is a statutory maximum of £17.5 million, for which the Fining Guidance was followed: 

1. An assessment of the seriousness of the infringement reduced the starting point to 80%. 
2. The Commissioner then accounted for PSNI’s turnover, deciding that “an adjustment of 40% is appropriate to reflect the PSNI’s size.” 
3. Following the above adjustments, the fine’s starting point was calculated by multiplication from £17.5 million to a resultant £5.6 million – which was maintained by the Commissioner as being effective, proportionate and dissuasive in the circumstances. 

However, the PSNI fall under the ICO’s revised approach to public sector enforcement, which is without objective calculation and in addition to the five step approach above. The Commissioner accordingly reduced the penalty from £5.6 million to £750,000. 

Relevant technical and organisational measures 

Private sector organisations should note the significance of the PSNI breach case, as a potential fine of up to £17.5 million depending on an organisation’s size. This may however still present a lesser risk than the broader compliance considerations of such a breach, including reputational harms and individual or class action legal claims for damages. The ICO accordingly reiterates UK data protection law requirements that appropriate TOMs must be in place to ensure appropriate information security. 

Example technical measures include: 

• Pseudonymisation and anonymisation procedures

• Flattened file types for external sharing

Example operational measures include: 

• Appropriate staff training

• Information security audits and business continuity management

• Information Disclosure Procedures

PSNI’s failure to implement such appropriate TOMs was noted as negligence by the ICO and formed an aggravating factor in the Commissioner’s decision. This decision highlights how implementing data protection by design and default, including by implementing the above TOMs, can not only prevent breaches, but also result in more favourable considerations by data protection regulators. 

Trilateral’s Cybersecurity and Data Protection teams provide a coordinated approach to information risk compliance, with significant experience in advising public sector organisations subject to FOI requests and private sector organisations enhancing their privacy programmes. 

If you’d like to know more about how our data protection experts can support your organisation, check out the specialist services we provide. 

If you need to ensure your cybersecurity profile is up to date and compliant with new NIS2 regulations, download our new guide that will support you through implementation.