PSNI data breach discovered after an officer tried to stop family trip to US

In recent weeks all those impacted by the data breach have been contacted by the PSNI, and dozens of them have already sought the advice of a solicitor.

It is now understood that the data breach was uncovered in November 2020, when the Police Ombudsman received a referral from the Chief Constable Simon Byrne in relation to the potentially unlawful disclosure of the personal data of four members of a family to United States authorities.

Information described as “sensitive” by the Police Ombudsman that related to three brothers and their mother, had been inappropriately shared by police with the United States Department of Homeland Security and an official in the US Consulate in Belfast.

The information had not been requested by US authorities.

It included photographs and criminal records of the brothers and details about their mother.

One of the brothers had been subject to bail conditions which were varied by a judge to allow him to travel to the United States for a family holiday.

However, on the day before he was due to travel, a police officer sent details about him, his two brothers and his mother to US authorities.

The man was refused travel and his bail conditions were reinstated.

Police were also aware that the man subsequently planned to travel to Spain, and an international alert was placed on his record so that he — and anyone accompanying him — would be stopped entering the country.

A police officer also stated in an email that he may be able to have the man’s passport cancelled.

The Police Ombudsman identified “significant systemic deficiencies in the operating procedures” which governed the operation of the PSNI’s Extradition and International Mutual Assistance Unit (EIMAU).

Ombudsman Marie Anderson said: “My investigation identified inadequate training, procedures and protections within the EIMAU, which interfered with peoples’ human rights and a failure by police to comply with data protection obligations.

“I am hopeful, as a result, that there will not be a recurrence of the serious issues identified during my enquiries,” she said.

The Police Ombudsman investigation centred on potential breaches of Article 8 of the Human Rights Act 1998, which relates to the right to respect for private and family life.

Potential offences were also considered in relation to the Computer Misuse Act 1990 and the Data Protection Act 1998.

“I was mindful of the personal and sensitive nature of the information disclosed by PSNI officers,” said Mrs Anderson.

“The failings I identified were organisational rather than matters of individual culpability by police officers.

“I welcome that the PSNI has accepted and actioned all of the above recommendations in relation to this complex and sensitive area,” said Mrs Anderson.

Some of those impacted by the data breach have no criminal convictions, nor have they ever been arrested or accused of any crime.

One woman who received a letter believes she is a victim of mistaken identity as she shares a name with someone who would be known to police.

The woman first realised there was an issue around 14 years ago when she was stopped going through security in America, handcuffed and refused entry.

Since then she has had numerous issues when travelling.

She was one of the 152 people contacted in relation to the recent data breach and a relative says she hopes she will finally get answers as to why she has been targeted by foreign immigration agencies in the past.

Megan Burns of Phoenix Law said they have been contacted by 20 people who have received letters from the PSNI about the data breach.

“None of our clients have attempted to go to the US.

“We plan on sending letters to the PSNI privately and issuing civil proceedings.

"We also plan on sending letters to the Police Ombudsman and the Information Commissioner’s Office.”