ICO fines police force after rape victim details found on street

The Information Commissioner's Office (ICO) served the force with a £70,000 monetary penalty notice (11-page / 174KB PDF) after a member of public found details about the girl's name, address, telephone number, school, ethnic origin and details of her sexuality contained in a missing person's report lying on a street in Blackpool in July last year.

The report mentioned that the girl had been previously raped and featured the name of her attacker. It also contained the personal data about 13 other individuals, including the name and address for one person who had been referred to as a convicted child sex offender.

The ICO said the report was handed in to a local newspaper which published an anonymised story about it and that the story was later followed up by a national publication. The Blackpool Gazette reported that a dog walker had found a 10-page file on a teenage rape victim on a street in the town in July last year.

The ICO said that a Lancashire Constabulary officer had apparently taken the report out in a patrol car to look for the missing girl but that the report may have been accidentally left in the vehicle. It said that it appeared the report "fell out the car" days later when another officer was responding to a domestic dispute incident in the area it was found.

Lancashire Constabulary breached the Data Protection Act and has now signed an undertaking (2-page / 115KB PDF) to improve its data protection practices, the watchdog said.

"The fact that information as sensitive as this could go missing without anybody realising is extremely worrying, and shows that Lancashire Constabulary failed to have the necessary governance, policies and suitable training in place to keep the personal information they handle secure," Steve Eckersley, Head of Enforcement said in a statement. “The loss of this information and the news that it had been leaked to a local newspaper is likely to have been extremely distressing for all involved".

"While we are pleased that Lancashire Constabulary has agreed to take action to make sure people’s information is safe, it is vitally important that police forces have effective data protection policies in place for electronic and paper based systems, if they are to operate with the trust and confidence of the public they serve. This includes keeping a record of where personal information is being stored and used," he said.

The Data Protection Act requires that “appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data" by organisations in control of personal data. The Act requires extra care around the handling of sensitive personal data, such as information relating to individuals' "physical or mental health or condition" and sex life.

Lancashire Constabulary has committed to ensuring that personal data it controls is kept secure. In particular it will only remove "hard copy documentation" from police stations "when absolutely necessary" and make sure that the papers "contain the minimum amount of personal data required for its purpose and will be anonymised where possible".

The force will also introduce a new written policy "detailing employees’ specific responsibilities when removing personal data from the station, as well as its subsequent use, protection and return". The policy will also outline what checks officers have to make of vehicles. Staff at the Constabulary will receive data protection training on the policies.