Action taken against Staffordshire Police after victim's address wrongly disclosed to alleged abuser

We have reprimanded Staffordshire Police after the force unlawfully disclosed a domestic abuse victim's home address to their alleged abuser.

The incident occurred in March 2024 when Staffordshire Police issued a Domestic Violence Protection Notice (DVPN), an emergency measure intended to protect a victim from violence or threats of violence.

The notice included the victim's current address when it was served on the alleged perpetrator following their release from prison. The victim's address was not previously known to the alleged abuser and its inclusion in the notice was not lawful.

The data breach caused serious distress to the victim, who had previously moved home on several occasions to escape the alleged abuse.

Our investigation also found that Staffordshire Police failed to have appropriate measures in place to prevent an unauthorised disclosure, including poor completion rates for mandatory training in both data protection and issuing DVPNs.

Sally-Anne Poole, Head of Investigations at the ICO, said:

"Data breaches of this kind are never just technical failures. When someone comes forward as a victim of domestic abuse, they are placing their trust and their safety in the hands of the police. What might seem like a simple error, such as including an address in a document that didn't need it, can expose someone to real and immediate danger. In this case, the very notice designed to protect them instead put them at risk and left them fearing that they would have to relocate their family once again."

Staffordshire Police has since made a number of improvements to reduce the risk of similar incidents happening in the future. These include increasing completion rates for relevant training, establishing new leadership roles around domestic abuse cases and investing in new technology to help improve services for victims in these cases. Internal procedures have also been updated to ensure that address details are not included in protection notices where they are not already known to the recipient.

Sally-Anne Poole added: "

This case is a reminder that getting the basics right is not optional. Every organisation must be doing everything necessary to protect the personal information in their care, especially where there is a known risk to someone's safety. Whether in policing, health or local government, we urge organisations to take responsibility for training their staff and putting appropriate systems in place to avoid these incidents and the harm they can cause. We welcome the improvements made by Staffordshire Police to both its policies and procedures."

Advice for organisations handling sensitive personal information

• Make sure relevant staff know how to handle the personal information of people experiencing domestic abuse with extra care and are able to accommodate any requests for privacy or security.
• Review default templates and processes to ensure personal information, such as addresses, is only included where it is legally necessary.
• Regularly check contact information, by confirming with people that their details are still accurate to avoid disclosing information to an old address, email or phone number.
• Always double check before any personal information is transferred, altered or disclosed - for example confirming an address has been redacted, an email address is correct, or all recipients are authorised to receive it.
• Ensure training is thorough and relevant by making it role-specific and tailored to the tasks staff actually carry out, so they feel confident handling personal data safely and securely.

In 2024, we launched its 'Ripple Effect' campaign with new resources as it urged organisations to recognise the real-world impact of data breaches and the devastating effects they can have on people's lives - especially those in vulnerable situations.

We also previously called on organisations to avoid putting victims of domestic abuse at the risk of further harm.