![](https://emergencyservicestimes.com/wp-content/uploads/2025/05/ESS-Button-resized.png")
The Police Service of Northern Ireland (PSNI) is set to receive a £750,000 fine for failing to protect the personal information of its entire workforce, the Information Commissioner’s Office (ICO) announced. The proposed fine follows a serious data breach involving the personal details of 9,483 PSNI officers and staff.
The breach occurred when sensitive information, including surnames, initials, ranks and roles, was inadvertently published online in a ‘hidden’ tab of a spreadsheet released in response to a freedom of information (FOI) request. An investigation by the ICO found that PSNI’s internal procedures for the safe disclosure of information were inadequate.
John Edwards, the UK Information Commissioner, highlighted the severe impact of this breach: “The sensitivities in Northern Ireland and the unprecedented nature of this breach created a perfect storm of risk and harm, demonstrating the damaging consequences of poor data security.”
Edwards shared accounts from those affected, who have had to make significant life changes due to fear for their safety: “Throughout our investigation, we heard many harrowing stories about the impact this avoidable error has had on people’s lives, from having to move house, to cutting themselves off from family members and completely altering their daily routines because of the tangible fear of threat to life.”
He emphasised that the breach could have been prevented with simple, practical policies and procedures: “It’s particularly troubling to note that straightforward, practical measures would have ensured this potentially life-threatening incident, which has caused untold anxiety and distress, did not happen in the first place.”
Edwards urged all organisations to review and strengthen their disclosure procedures to protect personal information effectively.
“I am publicising this potential action today to highlight the need for all organisations to check, challenge, and, where necessary, change disclosure procedures to ensure robust measures are in place to protect personal information.”
In September 2023, following the PSNI report and other high-profile data breaches, the Commissioner issued an advisory notice recommending public authorities adopt measures to prevent inappropriate disclosures in FOI responses.
Recognising the importance of public funds supporting essential services, the Commissioner applied a public sector approach to calculating the provisional fine, reducing it from a potential £5.6m to £750,000. This approach aims to balance accountability while ensuring funds are not diverted from crucial services.
In addition to the fine, PSNI has been issued a preliminary enforcement notice, requiring improvements in the security of personal information when responding to FOI requests.
“The reports highlight once again the lasting impact this data loss has had on our officers and staff and I know this announcement today will bring those to the fore again. Since the data loss occurred in August, the Police Service has worked tirelessly to devalue the compromised dataset by introducing a number of measures for officers and staff. We provided significant crime prevention advice to our officers and staff and their families via online tools, advice clinics and home visits.
“Work is ongoing to update current policies and develop a new Service Instruction as recommended by the ICO. Training of officers and staff is ongoing to ensure everything that can be done is being done to mitigate any risk of such a loss occurring in the future.”
Chris Todd, Deputy Chief Constable, Police Service of Northern Ireland.
The ICO’s findings are provisional, and the Commissioner will consider any representations from PSNI before finalising the fine amount and enforcement requirements.
The Northern Ireland Policing Board (NIPB) published a review into the Police Service of Northern Ireland (PSNI) data breach which occurred on last August, read our full story here.
NPCC cyber lead, Temporary Commissioner Pete O’Doherty of the City of London Police, previously spoke with Editor, Catherine Levin about why trust and confidence underpins the police’s role in both preventing and responding to cyber-attacks to keep the public safe. Full article available here.