Martin McGartland - Northumbria Police mistakenly sending personal data to wrong recipient by email

Freedom of Information Act 2000 (FOIA)

Thank you for your email received today in which you make a request for
information that Northumbria Police may hold in accordance with the Freedom
Of Information Act 2000

We are in the process of dealing with your request and a response should be
provided to you by 11/10/16 which is in accordance with the legislation.

Yours sincerely

Jan Mcewan
Disclosure Section

NORTHUMBRIA POLICE PRIVACY AND CONFIDENTIALITY NOTICE

The information contained in this message and any attachment(s) is confidential and intended only for the attention of the named organisation or individual to whom it is addressed. The message may contain information that is covered by legal, professional or other privilege. No mistake in transmission is intended to waive or compromise any such privilege. This message has been sent over public networks and the sender cannot be held responsible for its integrity.

If you are not the intended recipient be aware that any disclosure, copying, distribution or action taken in reliance of the information contained herein is strictly prohibited, and is contrary to the provisions of the Copyright Designs and Patents Act, 1988 and of the Data Protection Act, 1998.

Any views expressed are those of the sender and, unless specifically stated, do not necessarily represent the view of Northumbria Police.

We cannot accept any liability for any loss or damage sustained as a result of software viruses. It is your responsibility to carry out such virus checking as is necessary.

If you have received this message in error, please notify the sender by e-mail at once and delete the message immediately.

For more information about Northumbria Police please visit our website - http://www.northumbria.police.uk

Provision of Information held by Northumbria Police under the Freedom of
Information Act 2000 (the" Act")

With regard to your email in which you make a request for information that
Northumbria Police may hold.

I regret that Northumbria Police will not be able to complete its response
to you by the date originally stated.  We are still researching the
information held and considering whether any exemptions under the Act may
apply, in particular S40 and S31.

I can now advise you that the new date for the provision of a response is
08/11/2016.  
I can assure that every effort will be made to ensure that a response will
be provided to you within this new timescale.

Your attention is drawn to the attachment which contains your complaint
rights.

Yours sincerely

Peter Storey
Disclosure Section

NORTHUMBRIA POLICE PRIVACY AND CONFIDENTIALITY NOTICE

The information contained in this message and any attachment(s) is confidential and intended only for the attention of the named organisation or individual to whom it is addressed. The message may contain information that is covered by legal, professional or other privilege. No mistake in transmission is intended to waive or compromise any such privilege. This message has been sent over public networks and the sender cannot be held responsible for its integrity.

If you are not the intended recipient be aware that any disclosure, copying, distribution or action taken in reliance of the information contained herein is strictly prohibited, and is contrary to the provisions of the Copyright Designs and Patents Act, 1988 and of the Data Protection Act, 1998.

Any views expressed are those of the sender and, unless specifically stated, do not necessarily represent the view of Northumbria Police.

We cannot accept any liability for any loss or damage sustained as a result of software viruses. It is your responsibility to carry out such virus checking as is necessary.

If you have received this message in error, please notify the sender by e-mail at once and delete the message immediately.

For more information about Northumbria Police please visit our website - http://www.northumbria.police.uk

Provision of information held by Northumbria Police made under the Freedom
of Information Act 2000 (the 'Act')

Thank you for your e mail dated 13 September 2016 in which you made a
request for access to certain information which may be held by Northumbria
Police.

As you may be aware the purpose of the Act is to allow a general right of
access to information held at the time of a request, by a Public Authority
(including the Police), subject to certain limitations and exemptions.
 
You asked:

I would like to know how many times have Northumbria Police officers and
also civilian staff sent personal data by email to the wrong recipient by
mistake.  I would like this information to be broken down and to cover
following periods:  

1.  September 2011 to September 2012

2.  Septmber 2012 to September 2013

3.  September 2013 to September 2014

4.  September 2014 to September 2015

5.  September 2015 to September 2016

6.  Please confirm how many times there has been such a data breach
against the same individual on more than one occasion during the 5 year
period.  I would like details of the number of data breaches that there
have been against the same data subject, individual and also details and
reasons for it.

Additionally, I would also like to know what action was taken against
officers, staff involved and am requesting details on all/any such cases.
 I would also like to know reasons for each of the data breaches and how
and why they happened.

7.  Have any of the data breaches been reported to the Information
 Commissioners office, if so, please supply full details, as well as
supplying full information of all decisions, actions made by them against
Northumbria police, as well as any warnings or sanctions.

8.  Please supply full details of what actions Northumbria Police
undertake once it has been identified there has been data breach.
 Additionally, please disclose:

a.  At what stage do Northumbria police make the data subject aware of the
breach.

b.  Are Northumbria police under any obligation to notify data subject of
the breach in any particular timeline.  Please supply as much information
as possible to assist me with this request (including any ICO regulations
or guidance etc regarding data breaches).

We have now had the opportunity to fully consider your request and I
provide a response for your attention.

Following receipt of your request, searches were conducted with the
Professional Standards Department of Northumbria Police. I can confirm
that the information you have requested is held by Northumbria Police.

I am able to disclose the located information to you as follows.

1. No recorded incidents matching the request scope

2. One incident matching the request scope

3.One incident matching the request scope

4. No recorded incidents matching the request scope

5. Four recorded incidents matching the request scope

6. There has been only one instance matching the request scope in the
previous 5 years.
Two emails intended for the same recipient were sent to an incorrect
address – details below

+------------------------------------------------------------------------+
| 20/05/2016 | An email containing | A procedural change has been |
| | details of a | put in place to use "cut and |
| | non-recording letter was | paste" from the recorded |
| | sent to an incorrect | email address field |
| | email address.  The email | |
| | did not contain any | |
| | sensitive personal | |
| | information | |
|------------+---------------------------+-------------------------------|
| 25/07/2016 | An email containing a | This was the second incident |
| | confirmation letter and | of this type involving the |
| | an allegation summary was | same individual, consequently |
| | sent to an incorrect | a meeting was held with the |
| | email address.  The email | organisational SIRO where it |
| | did not contain any | was decided to self-refer to |
| | sensitive personal | the ICO.  The staff involved |
| | information | will be subject to retraining |
| | | in protecting information.   |
+------------------------------------------------------------------------+

All recorded breaches are deemed to be simple human error caused by either
incorrect recording of contact details or incorrect typing of email
addresses.

7. Two instances have been referred to the ICO.  These are  still under
consideration by the ICO so no decisions, actions, warnings or sanctions
have been issued to Northumbria Police at the present time.

8. All reported data breaches are recorded and investigated by the Force
Information Security Officer
a. No information held.  We hold no information regarding such time
scales.  Each breach will be assessed on a case by case basis
b. No information held.  Northumbria Police are under no obligation to
notify a data subject of a breach within a particular timeline.  Each
breach will be assessed on a case by case basis.

See below Procedure document 'Reporting of Security Incidents and
Weaknesses'.

Further  information regarding data breaches can be found on the ICO
website

In order to assist I have provided two relevant links below for you.

[1]https://ico.org.uk/media/1536/breach_rep...

[2]https://ico.org.uk/media/1562/guidance_o...
Due to the different methods of recording information across 43 forces, a
specific response from one constabulary should not be seen as an
indication of what information could be supplied (within cost) by another.
 Systems used for recording these figures are not generic, nor are the
procedures used locally in capturing the data.  For this reason responses
between forces may differ, and should not be used for comparative
purposes.

The information we have supplied to you is likely to contain intellectual
property rights of Northumbria Police.  Your use of the information must
be strictly in accordance with the Copyright Designs and Patents Act 1988
(as amended) or such other applicable legislation.  In particular, you
must not re-use this information for any commercial purpose.

You may be interested to know that Northumbria Police routinely publish
information via the Disclosure Log.  The aim of the Disclosure Log is to
promote openness and transparency by voluntarily placing information into
the public arena.

The Disclosure Log contains copies of some of the information that has
been disclosed by Northumbria Police in response to requests made under
the Freedom of Information Act 2000.

Whilst it is not possible to publish all responses we will endeavour to
publish those where we feel that the information disclosed is in the wider
public interest.

The Disclosure Log will be updated once responses have been sent to the
requester.
I have provided the relevant link below.

[3]http://www.northumbria.police.uk/freedom...

How to complain

If you are unhappy with our decision or do not consider that we have
handled your request properly and we are unable to resolve this issue
informally, you are entitled to make a formal complaint to us under our
complaints procedure, attached below

[4]http://www.northumbria.police.uk/freedom...

If you are still unhappy after we have investigated your complaint and
reported to you the outcome, you may complain directly to the Information
Commissioner’s Office and request that they investigate to ascertain
whether we have dealt with your request in accordance with the Act.

Yours sincerely

Michael Cleugh
Data Protection and Disclosure Advisor
Direct Dial:  0191 2956941
[NOT PROTECTIVELY MARKED]

NORTHUMBRIA POLICE PRIVACY AND CONFIDENTIALITY NOTICE

The information contained in this message and any attachment(s) is confidential and intended only for the attention of the named organisation or individual to whom it is addressed.  The message may contain information that is covered by legal, professional or other privilege.  No mistake in transmission is intended to waive or compromise any such privilege.  This message has been sent over public networks and the sender cannot be held responsible for its integrity.

If you are not the intended recipient be aware that any disclosure, copying, distribution or action taken in reliance of the information contained herein is strictly prohibited, and is contrary to the provisions of the Copyright Designs and Patents Act, 1988 and of the Data Protection Act, 1998.

Any views expressed are those of the sender and, unless specifically stated, do not necessarily represent the view of Northumbria Police.

We cannot accept any liability for any loss or damage sustained as a result of software viruses.  It is your responsibility to carry out such virus checking as is necessary.

If you have received this message in error, please notify the sender by e-mail at once and delete the message immediately.

For more information about Northumbria Police please visit our website - http://www.northumbria.police.uk

References

Visible links
1. https://ico.org.uk/media/1536/breach_rep...
2. https://ico.org.uk/media/1562/guidance_o...
3. http://www.northumbria.police.uk/freedom...
4. http://www.northumbria.police.uk/freedom...

Delivery is delayed to these recipients or groups:

[1]FreedomofInformationMailbox@notes.nbria.local

Subject: Re: Freedom of Information Act 2000 (FOIA) Request 992/16 - Data
breaches [NOT PROTECTIVELY MARKED]

This message hasn't been delivered yet. Delivery will continue to be
attempted.

The server will keep trying to deliver this message for the next 1 days,
19 hours and 59 minutes. You'll be notified if the message can't be
delivered by that time.

References

Visible links
1. mailto:FreedomofInformationMailbox@notes.nbria.local