Removal and disposal of sensitive information - Cleveland Police, June 2018

In June 2018 a member of the public found a work book and loose papers that contained police data – including sensitive information relating to sex offenders, victims and family members near a skip. The member of the public initially handed the papers over to an online news reporter, who subsequently returned it to Cleveland Police. The force identified the work book as belonging to one of their officers, who had stored it at their home. Cleveland Police recovered the rest of the sensitive material from the officer’s home and returned it to police premises.

Cleveland Police referred this to us as a conduct matter. The force also contacted all the people named in the work book to inform them of the release of their information to the public. Seven of them made complaints about the breach of their personal data, and the impact on them personally. We also investigated some of their complaints.

The evidence obtained during our investigation indicated that a Cleveland Police officer removed two bags containing some sensitive work-related material from police premises to their home. Our investigation found evidence that this material had been stored at the officer’s home for approximately four weeks before some of it was found by a member of the public.

Our investigators interviewed the officer and obtained statements from other relevant officers and several witnesses. We also reviewed relevant policies, guidance and legislation.

The evidence confirmed that the officer did remove the bags containing sensitive material from police premises and took them home, knowing some of the material was sensitive. While the officer explained why they stored the bags in their study, which the officer considered to be secure, the officer did not appear to have properly considered the risk to the data within their home, nor made attempts to secure or remove the sensitive material from their study to police premises at any time during the following 27 days.

The officer provided an explanation for how the material ended up outside of their house, which eventually led to a member of the public subsequently finding one of the work books in the road and contacting a national newspaper reporter. In our opinion, that served to undermine the officer’s stated view that they believed the material was safe in their study.

Police officers have a responsibility for the information they handle and process. Although officers can take sensitive material away from the police station when required to do so for a legitimate policing purpose, the increased risks to the security of this material should be considered. We saw little evidence that the officer had due appreciation of these risks, and there was no legitimate policing purpose in the officer removing this material from the police station and retaining it at their home for such a period.

We found no evidence that the officer deliberately disposed of the sensitive material by placing it outside their house. However, taking such material home and leaving it unsecure within their properly would amount to a very serious error on the officer’s part, if proven.

Based on the evidence available, we were of the opinion that a reasonable panel, properly directed, could find a case to answer for gross misconduct for the officer.

Our investigation also identified that another officer appeared to have failed to ensure the sensitive material that was contained in the bags was stored, processed or protected in a manner compliant with the Data Protection Act or Cleveland Police force policies. We were of the view that this officer may benefit from receiving management action.

We also suggested that the force may consider reviewing their Data Protection policy.

We completed our investigation in August 2019.

After reviewing our report and provisional opinions, Cleveland Police initially determined that the officer had a case to answer for misconduct only. We did not accept that determination. After further exchanges of views, the force agreed that the officer should attend a gross misconduct hearing. Cleveland Police also advised they would review their Data Protection policy to ensure it is adequate.

The officer attended a gross misconduct hearing in autumn 2019 where gross misconduct was proven. The officer was given a final written warning.