Incident: The hidden worksheet that published a workforce

Module 4 · Incident file · About 35 minutes

What happened

On 8 August 2023 the Police Service of Northern Ireland (PSNI) answered a freedom of information request. The request, received on 3 August, asked for "the number of officers and staff at each rank or grade", in tables. The answer was a spreadsheet, and it was published on the WhatDoTheyKnow website at 14:31. Inside it, unseen, was a worksheet holding the "surnames and first name initials, job role, rank/grade, department, location of post, contract type, gender and PSNI service/staff number" of all 9,483 officers and staff. The account here comes from the UK Information Commissioner's Office (ICO) penalty notice of 26 September 2024 (ICO, PSNI penalty notice) and its announcement of 3 October 2024 (ICO, "What price privacy?").

Officers alerted PSNI at about 16:10. The site hid the file at 16:51 and deleted it at 17:27, so it was public for about 2 hours and 20 minutes. On 14 August PSNI said it was "confident that the workforce data set is in the hands of Dissident Republicans". Officers' complaints to the ICO described fears for their safety and their families', changes to home security and "the need to relocate".

The ICO found that PSNI had infringed Articles 5(1)(f) and 32 of the UK GDPR: it had not used "appropriate technical and organisational measures" to keep the data secure. It fined PSNI £750,000. Its calculation came to £5.6 million first; it then applied its approach to public sector bodies and reduced the fine. This summary is drawn from the regulator's published documents and is not legal advice.