The Information Commissioner’s Office (ICO) has issued an enforcement notice and a formal reprimand to the Metropolitan Police Service after the force disclosed a stalking victim’s new contact details to the alleged perpetrator. The mistake, the regulator says, amounts to a serious breach of data protection rules and risks putting victims of crime in immediate danger.
What happened
The ICO announcement in August 2026 states that the Metropolitan Police sent the new address and contact information of a victim of stalking to the individual accused of offences against that person. The disclosure occurred in the course of police activity connected to the case and was revealed to the defendant, creating a clear safety risk for the victim.
The regulator’s investigation concluded that the Metropolitan Police failed to adequately protect the victim’s personal data and did not have sufficient safeguards in place to prevent such a disclosure. The ICO’s action is an enforcement notice requiring the force to take steps to come into compliance with data protection law, together with a public reprimand of the failings. The ICO press release and the enforcement notice set out the regulator’s findings in detail.
ICO findings and enforcement
The ICO’s role is to uphold information rights in the public interest. In this case, the regulator found that the police disclosure amounted to an unlawful processing of personal data under the UK General Data Protection Regulation and the Data Protection Act 2018. The enforcement notice compels the Metropolitan Police Service to implement corrective measures and to review and improve relevant policies and processes.
The ICO’s action underlines two priorities: protecting individuals’ safety where their personal data is concerned, and holding public bodies to account when they fail to meet statutory obligations. The regulator’s notice specifies the areas where the force must act, and the reprimand makes clear that the failings were serious enough to warrant public censure.
Readers can view the ICO’s public announcement and the enforcement notice on the regulator’s website: ICO press release. The ICO also provides guidance on data protection and law enforcement that explains the legal framework the regulator applied in reaching its decision.
Metropolitan Police response and next steps
The Metropolitan Police Service has been notified of the enforcement notice and is required to comply with its terms. The force will need to carry out improvements to internal procedures and staff training to prevent future disclosures. The ICO’s notice will include timelines and expectations for how the Met must remedy the identified failings.
It is normal in cases of regulatory enforcement for an organisation to cooperate with the ICO and to set out proposed remedial measures. The ICO retains the power to monitor compliance and to escalate action if necessary. The Metropolitan Police Service has a statutory duty to protect victim safety; any improvements required by the ICO are intended to strengthen those protections in practice.
Impact on victims and frontline policing
For victims of stalking and other offences, the disclosure of new contact details is deeply alarming. Confidential addresses, alternative contact numbers and safety planning details are routinely handled by police and criminal justice agencies, and any failure to keep that information secure can directly endanger people. The ICO’s intervention highlights the need for robust information governance across all frontline teams.
Police forces must balance transparency, prosecutorial needs and the safety of victims when sharing information. This case demonstrates how weaknesses in procedure or human error can tilt that balance in the wrong direction. It also serves as a reminder for victims that they should raise any concerns about how their information is being handled with their dedicated police officer or specialist units supporting vulnerable people.
Legal and policy context
Under the UK GDPR and the Data Protection Act 2018, personal data must be processed lawfully, fairly and transparently. Special category data and information that may put someone at risk require additional safeguards. Public authorities such as police are both controllers and processors of personal data and must demonstrate compliance with data protection principles when collecting, storing and sharing information.
Enforcement notices are one of the ICO’s regulatory tools and are issued when an organisation must take specific actions to comply with the law. A reprimand is a formal statement highlighting wrongdoing and is used where the ICO considers conduct to be significantly deficient. The combination of an enforcement notice and reprimand in this case signals the regulator’s concern about the seriousness of the breach.
Practical advice for victims and the public
If you are a victim concerned that personal information held by a public body might put you at risk, consider taking these steps:
- Raise the matter with your allocated police officer or the force’s specialist unit for vulnerable victims and ask for confirmation of how your details will be protected.
- Seek advice from victim support services about safety planning and how to register concerns formally with police or other agencies.
- If you believe your data has been mishandled, you can contact the ICO to make a complaint about data protection practices.
Victims should also be aware of local services and community organisations that provide practical help and temporary accommodation in cases where an address has been compromised. For those seeking a short break from stress while accessing support, lifestyle and wellbeing pieces such as our feature, I checked in, switched off and had the perfect London night out, may offer ideas for respite, though specialist safety planning should come first.
Balanced perspective and accountability
Data protection enforcement is not about penalising public services without reason. It is about ensuring organisations that hold sensitive personal information operate to standards that keep people safe. The ICO’s action aims to drive improvements that will protect victims and restore public confidence in how the police handle sensitive information.
At the same time, police forces operate in complex and high-pressure environments. Investigators, prosecutors and frontline officers often have to share information to pursue justice. The challenge for forces is to ensure those operational needs are met without putting individuals at risk. Clear guidance, regular staff training and effective oversight are essential to achieving that balance.
Conclusion
The ICO’s enforcement notice and reprimand to the Metropolitan Police Service mark a serious rebuke for the force. The action highlights the real-world consequences of data protection failures for victims of stalking and other crimes. Moving forward, the priority will be swift implementation of corrective measures, transparent oversight and stronger safeguards to ensure confidential information is handled with the care victims expect and the law requires.
