THE PSNI HAS been fined £750,000 (€895,000) over a major data breach that saw the personal details of police and intelligence officers published online.
The identities of all 9,483 staff of the PSNI were mistakenly published online on 8 August, 2023, following a Freedom of Information request.
The FOI request sought the number of officers and staff of all ranks and grades across the organisation.
In the published response to this request, a table was embedded which contained the rank and grade data, but also included detailed information that attached the surname, initial, location and departments for all PSNI employees.
The data was potentially viewable by the public for between 2.5 to three hours and the PSNI described it as a “critical incident”.
Six days later, the PSNI said it was “aware that dissident republicans claim to be in possession of some of this information” and the names of up to 40 officers working for MI5 intelligence in Northern Ireland were believed to be among the published data.
The fine was imposed by the UK’s Information Commissioner’s Office (ICO).
The ICO said it was “mindful of the current financial position at PSNI” and as a result, the “Commissioner used his discretion to apply the public sector approach in this case”.
Had this discretion not been applied, the fine would have been £5.6 million (€6.7).
The UK Information Commissioner John Edwards said he “cannot think of a clearer example to prove how critical it is to keep personal information safe”.
He added that it’s “impossible to imagine the fear and uncertainty this breach – which should never have happened – caused PSNI officers and staff”.
Edwards said a “lack of simple internal administration procedures resulted in the personal details of an entire workforce – many of whom had made great sacrifices to conceal their employment – being exposed”.
“Let this be a lesson learned for all organisations. Check, challenge and change your disclosure procedures to ensure you protect people’s personal information,” said Edwards.
Jon Boutcher, chief constable of the PSNI, said the fine is “regrettable given the financial constraints we are currently facing”.
The PSNI’s chief constable at the time, Simon Byrne, quit one month after the breach and a string of other scandals rocked confidence in the authority.
The ICO announced in May that it intended to issue a £750,000 fine and Boutcher said the PSNI accounted for the majority of this in last year’s budget.
Boutcher added that “work is ongoing to ensure everything that can be done is being done to mitigate any risk of such a loss occurring in the future”.
He also said that the personal testimonies of PSNI officers to the INCO’s investigation “serve as a stark reminder of the impact the data loss had on our officers and staff”.
One PSNI officer told the investigation that he had to leave the PSNI because “everything had become too much for me”.
“I am essentially taking a pay cut, not to mention leaving the job that I dreamed of since I was a small child and geared my whole life towards,” said the officer.
Another told the ICO investigation that they had “gone to great trouble to ensure that I have remained invisible, with no social media presence, never revealing my job to others and lying about where I work whenever asked”.
This officer said they had trouble sleeping and that their children were “stressed about my welfare” and had “nightmares about me getting attacked”.
Another said they can’t sleep at night and had “spent over £1000 installing modern CCTV and lighting around my home because of the exposure”.
To embed this post, copy the code below on your site
have your say