Office run by Sadiq Khan revealed identities of people who had complained about Met Police

The crime office run by Sadiq Khan has been reprimanded over a data breach in which hundreds of people’s complaints about the Metropolitan Police and reports to the Victims’ Commissioner were accidentally made public.

Nearly 400 people have been notified that a trove of “highly personal information” - including their names, ages and reasons for getting in touch - could have been seen on the internet after the “completely avoidable” incident.

The Information Commissioner’s Office (ICO) said the error had the potential to “jeopardise public confidence in the criminal justice system” and formally reprimanded the Mayor’s Office for Policing and Crime (MOPAC).

The blunder occurred in November 2022, when a member of staff at the Greater London Authority, which runs a website for the Mayor and London Assembly, attempted to give four people at MOPAC - the GLA body responsible for oversight of the Met Police - access to information shared through two online forms.

One was used to lodge complaints about the Met and a second to contact the Victims’ Commissioner for London. Instead, they accidentally made the data available to everyone.

It meant that, with the click of a button, ordinary users could see everything that had been submitted via the forms, including the names and addresses of complainants and the reasons they had complained.

While it was a member of the GLA’s staff who made the error, the ICO determined that MOPAC should be reprimanded because the GLA processes data on MOPAC’s behalf.

In its report, the ICO said MOPAC had been “unable to evidence that there was any specific training to the members of GLA staff around granting permissions on ‘webforms’”.

It added: “Further to this, there was no policy in place at the time of the incident on how permissions should be granted at either MOPAC or GLA.”

MOPAC was alerted to the incident in February 2023 by a member of the public.

No evidence data was accessed

Some 394 people were notified that their personal information had been made publicly available. However, the ICO said there was no evidence that the data had been accessed.

Anthony Luhman, director at the ICO, said: “People used these forms for two reasons – to complain about the Metropolitan Police, or to contact the Victims Commissioner for London about the way they had been treated.

“This means highly personal and sensitive information could have been seen publicly. This was a completely avoidable error that had the potential to jeopardise public confidence in the criminal justice system.

“I am satisfied this was an honest mistake and I’m pleased by the remedial steps taken by MOPAC since the breach, which include providing additional staff training to prevent any repeat incidents.

“However, it is important that public bodies learn from this incident. The public should be able to trust that their sensitive data will be treated with the utmost care, particularly when it comes to crime.”

The forms had different purposes. One allowed people to voice concerns about how the Met had handled their complaints. The other enabled users to contact the London Victims’ Commissioner, Claire Waxman, who was appointed by Mr Khan in 2017 to “stand up for survivors of crime across the capital”.

Susan Hall, the Tory candidate for London Mayor, said: “Since Sadiq Khan has abdicated his responsibilities on crime, it’s no surprise he’s dropped the ball on data protection rules like this. It’s a shambles and once again shows that London needs a Mayor who will listen to people and focus on the job.”

The Mayor has been approached for comment.