Fighting Crime But Forgetting Data Protection

Recently, the Information Commissioner took enforcement action against the Chief Constables of three East Midlands police forces who failed in their data protection obligations, in establishing a collaboration scheme set up to pool unit resources and share expertise.

Whilst the benefits (and sometimes the necessity) of collaboration are apparent, parties involved in any collaborative project should be alert to their data protection responsibilities and ensure appropriate safeguards are in place.

Background

The East Midlands Collaboration Unit ("EMCU") comprises five regional police forces. In August 2010, its headquarters were, ironically, burgled and the laptops of eight officers on secondment were stolen. The laptops contained the personal data of over 4000 people, including files relating to prison records.

Measures

The Data Protection Act 1998 requires "appropriate technical and organisational measures [to be taken]... having regard to the state of technological development and... cost... [so as to] ensure a level of security appropriate to the harm that might result from... accidental loss [of data]... and the nature of the data to be protected."

Given the sensitivity of the personal data potentially compromised, suitable measures were not taken by the members of the EMCU in this instance: the laptops were not locked away, two of them were unencrypted and a risk assessment was not carried out in terms of the officers' remote deployment of the laptops.

Summary

The Information Commissioner's investigation into the EMCU data breach suggests that its failings...