The London Mayor’s Office has this week been reprimanded by the Information Commissioner’s Office for a glitch that potentially revealed the personal information of people who had complained about the Metropolitan Police Service.

The London Mayor's Office for Policing and Crime had two forms on its website: one to contact the Victims Commissioner for London and another to raise a complaint about how the Met had handled their original complaint.

An error on the part of Greater London Authority, which runs the London.gov.uk website, including MOPAC's pages and webforms, led to the incident. In November 2022, a member of GLA intended to give four members of staff at MOPAC permission to access information shared through the web forms. Instead, they accidentally made access to the two web forms public. In February 2023, MOPAC were made aware of a potential incident by a member of the public. Upon further investigation, MOPAC discovered that it was possible for users to see everything that had been submitted via the form, including name, address and reason for submitting a complaint.

Due to the nature of the personal information that was made publicly accessible on the forms, MOPAC later notified 394 people that their data had been made available in error, although there is no evidence that the data was ever accessed.

“This was a completely avoidable error that has the potential to jeopardise public confidence in the criminal justice system,” said Anthony Luhman, Director at the ICO. “I am satisfied this was an honest mistake and I’m pleased by the remedial steps taken by MOPAC since the breach, which include providing additional staff training to prevent any repeated incidents.

“However, it is important that public bodies learn from this incident. The public should be able to trust that their sensitive data will be treated with the utmost care, particularly when it comes to crime.”

---