April 8, 2019

The ICO has fined the London Borough of Newham £145,000 for disclosing the personal information of more than 200 people who featured on a police intelligence database, known as the “Gangs Matrix”, the purpose of which is to record information in respect of alleged gang members.

An ICO investigation found that in January 2017 a Newham Council employee sent an email to 44 recipients that contained both redacted and unredacted versions of the Gangs Matrix. These had previously been sent to the council by the Metropolitan Police Service (MPS) as part of its work with partners to tackle gang violence.

As a result of the breach, information was shared relating to 203 people. This included dates of birth, home addresses, and information on whether they were a prolific firearms offender or knife carrier, as well as their alleged associated gang.

The ICO investigation found that between May and September 2017 rival gang members had obtained photographs of this information via the social media platform Snapchat. The Gangs Matrix featured in the photographs was the unredacted version that had been disclosed by Newham Council to partners in January 2017.

In 2017, the Borough of Newham experienced a number of incidents of serious gang violence. Victims of the violence included people who featured on the inappropriately shared Gangs Matrix.

The ICO said that it was not possible to say whether there was a causal connection between any individual incidents of violence and the data breach. However, the ICO highlighted the significant harm and distress that can be caused when this type of sensitive personal information is not kept secure.

The investigation also found that Newham Council did not report the data breach to the ICO. Whilst the council did conduct their own internal investigation, it did not start until December 2017, a significant time after they became aware of the breach.

Additionally, the ICO found that the council did not have any specific sharing agreements, policy or guidance in place to determine how its own staff and partner organisations should handle and use the Gangs Matrix databases securely. To read the ICO’s press release in full, click here.