The Information Commissioner’s Office (ICO) has announced it intends to fine the Police Service of Northern Ireland (PSNI) £750,000 in light of last year’s major data breach.

In August 2023, personal information—including surnames, initials, ranks, and roles of all 9,483 serving PSNI officers and staff—was included in a “hidden” tab of a spreadsheet published online in response to a freedom of information (FOI) request.

The information was published online for about two hours before it was removed.

The regulator’s investigation has provisionally found the PSNI’s internal procedures and sign-off protocols for the safe disclosure of information were inadequate.

The provisional fine of £750K is a fraction of the £5.6 million cost that would’ve been set had the ICO not applied its public sector approach.

The aim of the approach is to not divert away public money from where it’s most needed, in recognition that public money is best used to support the delivery of essential services.

Recommended reading

• Northern Ireland Police Data Breach Revealed Thousands of Officers’ Names
• Human Error Spurs Data Breach Surge
• Which Data Breaches Had Everyone Talking This Year?

Speaking on the incident, John Edwards, UK information commissioner, said: “The sensitivities in Northern Ireland and the unprecedented nature of this breach created a perfect storm of risk and harm – and show how damaging poor data security can be.

“Throughout our investigation, we heard many harrowing stories about the impact this avoidable error has had on people’s lives – from having to move house, to cutting themselves off from family members and completely altering their daily routines because of the tangible fear of threat to life.

“And what’s particularly troubling to note is that simple and practical-to-implement policies and procedures would have ensured this potentially life-threatening incident, which has caused untold anxiety and distress to those directly affected as well as their families, friends and loved ones, did not happen in the first place.

“I am publicising this potential action today to once again highlight the need for all organisations to check, challenge and, where necessary, change disclosure procedures to ensure they have robust measures in place to protect the personal information people entrust to them.”

The commissioner’s findings are provisional and a final decision is yet to be made.