ICO reprimands Staffordshire Police for disclosing a victim's address to abuser

The Information Commission (ICO) has issued a formal reprimand to Staffordshire Police after the force unlawfully disclosed a domestic abuse victim's home address to their alleged abuser.

The breach occurred in March 2024 when the force served a Domestic Violence Protection Notice (DVPN) on the alleged perpetrator following their release from prison. The notice improperly contained the victim's current residential address, which was not previously known to the recipient. The unlawful disclosure caused severe distress to the victim, who had relocated multiple times previously to escape abuse.

The ICO determined that Staffordshire Police infringed Sections 35(1) and 40 of the Data Protection Act 2018 (DPA18). The investigation identified systemic governance failings, noting that the force lacked appropriate preventative measures and recorded poor staff completion rates for mandatory training in data protection and DVPN issuance.

Staffordshire Police has since introduced corrective measures, including revising internal procedures to ensure confidential addresses are excluded from future notices. The force also increased mandatory training compliance, appointed dedicated domestic abuse leads, and invested in new technology to support victim services.

Training announcement: Freevacy provides comprehensive training for new and existing practitioners on the changes introduced by the DUA Act to the UK General Data Protection Regulation (GDPR), the Data Protection Act 2018 (DPA18), and the Privacy and Electronic Communications Regulations 2003 (PEC-Regulations). Our courses are always up to date and provide a forum for learning and discussing how to ensure your data protection processes remain compliant. Find out more.