Serious data breach by Suffolk and Norfolk police forces affecting victims of crimes and witnesses

Leading data breach lawyers say that the recent announcement by Suffolk and Norfolk police forces that it has inadvertently included details of victims and witnesses, involved in domestic and sexual abuse cases, within responses to Freedom of Information (“FOI”) requests is likely to lead to substantial claims for compensation by those affected.

 The statement confirms that a technical issue led to sensitive personal information being included in response to FOI requests relating to crime statistics, issued by the forces between April 2021 and March 2022. The forces have confirmed the data was ‘hidden’ from anyone opening the files, though should not have been included in the responses. Ongoing investigations have been unable to confirm how widely the information has been accessed.  

The data affected by the breach includes ‘personal identifiable information on victims, witnesses, and suspects, as well as descriptions of offences. It related to a range of offences, including domestic incidents, sexual offences, assaults, thefts and hate crime’. 

Suffolk Police’s Temporary Assistant Chief Constable, Eamonn Bridger, who led the investigation on behalf of both forces, apologised for the data breach and the impact on those affected.  

The forces confirmed that affected individuals will be contacted by letter, phone or in person by the end of the September.  

The data breach has been reported to the Information Commissionier’s Office (ICO) and comes less than a year on from Suffolk Constabulary’s previous data breach affecting victims of sexual offences, in November 2022.  

Sean Humber, a data breach specialist and partner at Leigh Day, who has successfully acted in a series of claims relating to the unauthorised disclosure of confidential information over the last 20 years, including claims against the police, stated: 

“This is a serious data breach given the sensitivity of the information involved. Disappointingly, with proper policies and practices in place, it was also entirely preventable. The first priority is to understand what has happened, including exactly what personal data has been released and address any risks posed to those affected.” 

Gene Matthews, a partner at Leigh Day, who has successfully acted in a succession of group claims over the last 20 years, added: 

“It is likely that the Forces will now face a significant fine from the Information Commissioner’s Office for failing to keep this personal information secure. Entirely separately, those affected are likely to have claims for compensation for the distress and any losses caused by the breach.”