Police Data Breach Compensation Claims

By Jo Greenwood. Last Updated 10th October 2024. Whether you’ve committed or are accused of committing an offence, are the victim of a crime, or have witnessed a crime, the police are likely to have processed or stored some of your personal data.

But did you know that it may be possible for that data to have been breached and that if it has, and you’ve been harmed emotionally or financially because of a breach of your data, you could make data breach claims against the police?

This guide sets out the information you may need to know if you’re looking to claim for a police data breach or criminal justice data breach. In the sections below, we provide guidance on the laws that protect your personal data, how it could be breached and how a breach could affect you. We also offer guidance on making data breach claims against the police or the Ministry of Justice, including details of the benefits of using a lawyer to make a claim.

In addition to this, we explain how we could help you begin a claim without you having to pay a penny until your claim has been successfully settled. If you’d like us to check your eligibility to make a police data breach claim, or you know you’re eligible and would like our help to start your claim, you can call the Legal Expert team on 0800 073 8804 at any time.

Select A Section

• Can I Claim Compensation For A Police Data Breach?
• How A Police Force May Breach A Person’s Data Protection Rights
• Examples Of Police Data Breaches
• Should I Report A Police Data Breach?
• Data Breach Compensation Amounts
• Can I Make A Police Data Breach Claim On A No Win No Fee Basis?
• Make A Data Breach Claim Today
• Learn More About Police Data Breaches

Can I Claim Compensation For A Police Data Breach?

To be eligible to make a personal data breach claim following a police data breach, you will need to prove the following:

• Your personal data was involved in the breach.
• The breach was caused by the organisation’s failings.
• You suffered financial loss or mental harm as a result of the personal data breach.

Personal data is any information that could directly identify you or identify you in combination with other information. Your name, home address and national insurance number are all examples of personal data.

Any organisation that processes your personal data must adhere to rules and regulations set out for them in the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA), as together they make up data protection law. Per data protection law, any organisation processing your personal data must take all the necessary steps to protect it. Failure to do so could result in a data breach, and your personal data could be compromised.

A personal data breach is a security incident that affects the confidentiality, availability or integrity of personal data.  You could be eligible to make a  data breach claim. However, you will need to prove that your personal data was compromised because of the organisation’s failings. This could occur through human error or as the result of criminal activity. Additionally, you will need evidence that shows you suffered financial losses or psychological harm because of this compromise in your personal data.

If you are eligible to make a claim against the police for a personal data breach, you will also need to adhere to the time limits. Generally, you will have 6 years to start a personal data breach claim. This is reduced to one year if the claim is against a public body.

If a UK GDPR breach by the police involved your personal information, you could be eligible to claim compensation. Contact our advisory team to find out more.

How A Police Force May Breach A Person’s Data Protection Rights

A data breach by the police could happen in a number of different ways. These could include:

• A letter being mistakenly posted to the wrong address, when the systems should have been updated to reflect a change of address so that this did not happen. For example, an ANPR data breach could happen if the relevant department sent a letter to your old address because you were suspected to have parked illegally, or were accused of speeding.
• The loss or theft of sensitive information technology hardware, such as USB sticks, laptops, computers and other devices that contain data. For example, if a laptop was stolen and it had access to the Police National Computer, a data breach could occur if someone was able to log into it.
• A government department being subjected to a cyber attack. Whether this leads to a courts data breach, a PNC data breach or any other breach of your data, if you are harmed by it, financially or emotionally, this could lead to a claim if the attack was possible because computer equipment had not been updated/kept secure.
• A recent example of a real-life breach can be found in the PSNI data breach which saw the personal information of all members of the Northern Ireland police force shared by a member of staff accidentally when responding to a Freedom of Information request.

These are just a few examples. If you’ve suffered a criminal justice data breach, an Automatic Number Plate Recognition data breach, or any other breach of your personal data by the police or any department within the criminal justice sector, we could assess your case to see if you could claim.

What Could Happen If Personal Data Is Breached?

If your personal data is breached, this could lead to identity theft, financial theft, fraud, loss of privacy and emotional distress. If you believe that you have suffered material or non-material harm due to a breach of your police data, data protection laws allow you to seek compensation through data breach claims against the police.

Examples Of Police Data Breaches

If you’re interested in learning more about data breaches that have happened within the police force, the two cases below might be of interest to you.

Metropolitan Police Data Breach (2018)

In 2018, the ICO ruled that a data breach had occurred in relation to a database known as the Gangs Matrix. This database held the details of alleged gang members, and while the ICO ruled that there was a specific purpose for the data to be on the database, the way in which it was used was not compliant with data protection rules.

As a result of the ICO investigation, it issued an enforcement notice, which gave the force 6 months to implement changes to ensure it did not risk Metropolitan Police data breaches of the same nature in future. The timing of this case meant it was dealt with according to the Data Protection Act 1998, as opposed to GDPR and the Data Protection Act 2018.

Greater Manchester Police Data Breach

In October 2020, a statement was posted on Greater Manchester Police’s website, revealing that they were investigating a potential data breach. The police reported the potential breach to the ICO, and investigations were ongoing at the time.

While neither of these incidents has led to a police force data breach fine, we should mention that the ICO has the power to enforce breaches of data protection laws by fining those responsible. In fact, a Ministry of Justice data breach led to the MoJ being fined £140,000 in 2013 when it was found that details of all inmates serving time at HMP Cardiff were sent to 3 inmates’ families. (Source: https://www.lawgazette.co.uk/practice-management/moj-fined-140000-for-data-breach/5038309.article)

Should I Report A Police Data Breach?

If you believe your personal details have been breached, you may be interested to learn that the ICO advises you to raise a complaint with the organisation that holds your data; in these cases, this would be the police themselves. The ICO suggest that you put your complaint in writing, make sure it is addressed the appropriate department, and give a timescale as to which you would like a response.

In your report, the ICO advise you to be specific, stating the nature of the breach and how you believe it happened. You could also mention how you have been affected by the police data breach.

If the police don’t respond to your report in a timely manner, you could escalate your complaint to the ICO and ask them to investigate. Complaints to the ICO should be made within three months of the breach, however, as if there are delays in bringing your case to their attention, they may not investigate.

We should advise you that whether you report your case to the ICO or the police or not, you could still seek legal advice and make a claim against them for a breach of your personal data. There are, however, time limits to claiming; 6 years for a police data breach and 1 year if you’ve suffered a breach of your human rights.

Data Breach Compensation Amounts

If your claim for a police data breach is successful, your compensation could be made up of up to two types of damage:

• Non-material damage – this refers to the emotional distress caused by the compromise of your personal data.
• Material damage – this refers to the financial losses you’ve suffered as a result of the compromise of your personal data.

To assist with valuing your emotional harm, those responsible for evaluating data breach claims may refer to the compensation brackets found in the Judicial College Guidelines (JCG). This document lists guideline compensation amounts for different types of physical and psychological injuries.

In our table below, we look at a few figures for psychiatric harm from the JCG. As every claim is valued based on the individual merits involved, our table does not represent how much compensation you might receive. We should also note that the first figure of this table has not been taken from the JCG.

Material Damage In A Police Data Breach Claim

Your settlement may also include compensation for your material damage. For example, if someone was able to gain access to your bank account following the compromise of your personal data, your funds could be taken. You will need to provide evidence of your material damage in order to claim compensation for it, such as with your bank statements, for example.

In addition to valuing your potential police data breach compensation, a member of our advisory team can also discuss your financial losses and what evidence you could save to recover these. Get in touch today using the contact details above.

Can I Make A Police Data Breach Claim On A No Win No Fee Basis?

If you’re eligible to make a police data breach claim, it may benefit you to do so on No Win No Fee terms. Specifically,  if one of our lawyers is connected with you, they could offer you a Conditional Fee Agreement (CFA).

Here is why you may want to be offered a CFA:

• There are no upfront solicitor fees to pay.
• There are no ongoing solicitor fees to pay.
• If the claim is not successful, there are no solicitor fees to pay at all.
• If your claim is successful, there are still no solicitor fees to pay directly from your pocket. Instead, your solicitor will take away a success fee from the compensation that has been awarded. A success fee is a small percentage. This percentage is also legally capped.

If you’re wondering whether you can begin a police data breach claim on a No Win No Fee basis, contact us and we’ll be happy to explain these terms in more detail. We can also answer other questions you have regarding your potential claim, such as “Can police share personal information?”.

Make A Data Breach Claim Today

If you would like to discuss your cases or ask us any questions about making data breach claims against the police, we’d be happy to help. We could also help you start your claim by providing you with a Legal Expert solicitor, who could help fight for compensation on your behalf. All you need to do is get in touch with us:

• Via telephone: 0800 073 8804
• By e-mailing the team: info@legalexpert.co.uk
• By using our handy Live Chat service
• Or, by completing the contact form.

Learn More About Police Data Breaches

Below, you can find more useful resources on what to do if you suffer damage because of a police data breach:

• General Advice – General advice on making a claim for a data breach can be found in this guide.
• What To Do If Data Is Breached?– The ICO offer guidance to organisations who may have suffered a data breach.
• How Could Data Be Used?– This is a useful resource from the ICO that talks about what data could be used for.
• No Win No Fee Lawyers– This guide explains more about No Win No Fee.
• Credit Card Data Breaches – This guide covers making a claim for a breach of credit card company data.
• Enforcement And The ICO – This page from the ICO website shows what actions they have taken for breaches.