N Ireland police faces fines and compensation claims after data blunder

Receive free Northern Ireland updates

We’ll send you a myFT Daily Digest email rounding up the latest Northern Ireland news every morning.

Northern Ireland’s police force is braced for fines and compensation claims after accidentally revealing details about its 10,000 officers and staff that it admitted may have fallen into the hands of dissident republicans.

Simon Byrne, chief constable of the Police Service of Northern Ireland (PSNI), said after a four-hour grilling by the force’s oversight body that he was “deeply sorry” for the data blunder on an “industrial scale”.

The PSNI on Tuesday accidentally uploaded to a public website a spreadsheet with the names and locations of all its officers and staff — including those with intelligence agency MI5 or in roles marked as “secret”.

The data, released in response to a freedom of information request, was not taken down for almost three hours. “We have to make some assumptions that we are liable to financial penalty either from the regulator or indeed from officers making a claim about the breach of their personal data,” Byrne said.

That could expose the PSNI to an as yet unquantifiable financial hit but the force’s immediate priority was the safety of its staff, he added.

More than 300 police were killed during Northern Ireland’s three decades-long Troubles, involving republican paramilitaries, loyalist gunmen and British security forces. Even though the conflict ended in 1998, police still routinely check under their cars for bombs and some — particularly nationalists who are still a minority in a force that was predominantly pro-UK during the Troubles — never tell family and friends what they do.

“We are now aware that dissident republicans claim to be in possession of some of this information circulating on WhatsApp and . . . are advising the officers and staff about . . . any further risk that they face,” Byrne said. He could not confirm whether any such groups had downloaded the data.

Marisa McGlinchey, author of Unfinished Business: the Politics of ‘Dissident’ Irish Republicanism, said the information could be a gold mine for active paramilitary groups such as the one that tried to murder a senior off-duty detective in February and killed journalist Lyra McKee in 2019.

“The police remain a key target for dissident republican groups who are keen to show that they’re still here and still capable,” said McGlinchey, who is assistant professor in political science at Coventry University.

“They are always looking for opportunities to collect information of use and a data beach like this will be seen as potentially very valuable to them. Particularly the officers who are working with MI5,” she added.

Officers and police staff have expressed their fear and fury at the data leak in a region where the security threat is officially classified as “severe”.

Deirdre Toner, chair of the Northern Ireland Policing Board, the oversight body, said “the personal impact of this data breach on the 10,000 PSNI officers and staff affected cannot be overstated”.

As the implications of the giant data drop were sinking in, the PSNI on Wednesday admitted another blunder, announcing that a spreadsheet, with 200 names on it, and a police-issue laptop and radio had been stolen from a private car more than a month ago.

“There’s a systemic failure here,” Chris Todd, assistant chief constable, said, admitting it was not yet clear why the news had not emerged earlier.

Byrne said the PSNI — already battling a £38mn funding gap — had not yet rehoused anyone as a result of the data leak but could face compensation claims and official fines. Lawyers say costs could run to £100mn.

Kevin Curran, professor of cyber security at Ulster University, said the Information Commissioner’s Office, the UK’s data protection watchdog, was currently being more lenient towards public sector bodies. But he said: “We have these regulations and companies spend a fortune trying to implement them and adhere to them. Why should the police be separate?”

The ICO said it was investigating the incident, adding that it “raises serious concerns as it shows how even the smallest of human errors can have major consequences”.