Mersey Reporter - #Merseybites #News

ACCORDING to Data Breach Claims UK over the past 2 years, nearly 60 data breach incidents have taken place within Merseyside Police.

Data breaches can occur within the Police through cyberattacks as well as human error, and this Police Force has experienced a number of security incidents.

Figures obtained by Data Breach Claims UK found that Police Officers and staff have access to vast amounts of personal data, which can include information such as:- a person’s name, phone number, email, or address.

As Police forces have to keep extensive records for investigations, they are seen as data controllers under the Data Protection Act 2018.

As a result, data breach incidents can occur where this personal data is destroyed, altered, or lost either accidentally or unlawfully, which can lead to a victim experiencing financial loss or psychological harm.

According to a study conducted by VPNoverview in 2020, UK Police Forces suffered more than 2,000 data breaches across the year, highlighting both the threat from ransomware used by cyber criminals as well as malicious insiders who may be working for the Police.

In 2023/24, Merseyside Police experienced 26 data breaches.

Over the past year, the Force has seen an increase in these security incidents, with 31 data breaches taking place.

Due to the sensitive nature of the information held, Police forces try and ensure that this data is handled with the utmost respect to maintain the public’s trust and confidence.

However, data breaches within the Force are a significant and growing concern as they can happen in many different ways.

Bethan Simons, Solicitor at JF Law, said:- “Breaches don’t always have to be complex cyberattacks, as breaches can often occur from human error. This can include:- misdirected emails, documents sent to the wrong address, the loss or theft of devices such as laptops or USB sticks containing sensitive information, or even the accidental publication of data, as seen with several UK forces. Internal mishandling is another cause of data breaches, such as:- Officers accessing data without authorisation or failing to redact certain sensitive details. To prevent these breaches, forces must prioritise data protection measures involving comprehensive training for staff on data handling protocols, encryption of devices, and strict policies regarding the sharing and retention of data."

Via freedom of information requests, Data Breach Claims UK also found out the most common types of data breaches that took place within Merseyside Police.

Unauthorised disclosure of data was the most common type of data breach, totalling:- 50 incidents, followed by paper documents being lost or stolen, which led to:- 3 breaches.

In 2024, the Information Commissioner’s Office (ICO) reprimanded West Midlands Police after they had incorrectly merged the records of 2 victims of crimes; however, one was also a suspect, and this was seen as a breach of the:- Data Protection Act 2018.

Mistakes like this within the Police can lead to inaccurate personal information being processed, ongoing investigations being affected, and data breach victims having their sensitive data leaked.

As a consequence of the data breaches the Force has suffered since 2023, 29 claims have been lodged against Merseyside Police looking for compensation.

Bethan Simons said:- "Information leaks can have a huge impact on victims as they can lead to:- identity theft, fraud, harassment, and severe emotional distress. If the Police Force's failings caused a data breach and you suffered financial or emotional harm as a direct result, then you may have grounds to pursue a claim, and it's crucial to seek legal advice promptly. Our Data Breach Claims UK offers support to those whose personal data was compromised in a Police data breach and can see if they have grounds to submit a claim. We operate a 24 hour helpline, with an online claim Form too, which you can access on our website."