Met Police gang database in ‘serious’ breach of data-protection laws, ICO finds
After being hit with enforcement notice, the London force is working with the regulator to improve its practices
A database of information on gang activity maintained by London’s Metropolitan Police Service (MPS) “led to multiple and serious breaches of data protection laws”, an investigation by the Information Commissioner’s Office has found.
The Gangs Matrix holds data on people suspected of being gang members. An ICO probe found that, while there is “a valid purpose for the database, the inconsistent way it was being used did not comply with data-protection rules”.
Breaches included keeping a data subject’s details “on an informal list of gang associates” even after they had been removed from the matrix. These lists were stored “on the relevant officer’s personal system drive”, the ICO said. Other formerly suspected gang members who had now been assessed as having “a risk score of zero” were not removed from the database at all.
“As a result, data subjects are never truly removed from the Gangs Matrix,” the ICO enforcement notice said. “Their personal data continues to be processed as though they remained connected with gangs. Their personal data and supposed association is shared with third parties and subject to the general policy of the MPS to encourage enforcement against them.”
- Current police ICT systems are in desperate need of change
- ICO flags urgent need for laws on political parties’ use of data and hits Facebook with £500k fine
- Government and police to set up £1.4m anti-gang social-media unit
The Met’s data-sharing activities saw full, unredacted personal data contained in Gangs Matrix records provided to “a range of public authority and private body third parties with both statutory and non-statutory functions”, according to the ICO.
The MPS has been cooperating with the regulator and has already “stopped sharing personal data on the Gangs Matrix with third parties where there is no individual sharing agreement in place”. The force is now working with the ICO to undertake a data protection impact assessment.
Deputy information commissioner of operations James Dipple-Johnstone said: “I am pleased that the MPS has been cooperating with us and has committed to bringing the Gangs Matrix in line with data-protection laws, and we will continue to work with them. I believe that by taking these steps and demonstrating that people’s data rights matter to them, the MPS will be able to build increased trust amongst their communities.”
The concept of the matrix – which is characterised as “the bedrock” of the Met’s anti-gang strategy – is laid out in the force-wide Gangs Operating Model policy. But each of London’s 32 individual boroughs is responsible for maintaining their own localised database. This data is then collated into a citywide database.
The ICO’s investigation was launched a little over a year after human rights organisation Amnesty International raised concerns about the Gangs Matrix.
Deputy assistant commissioner of Met Operations Duncan Ball said: "The Gangs Matrix is an intelligence tool that the Met uses to reduce the impact of gang violence on the communities of London. It is designed to assist us in effectively targeting violent offenders and prevent victimisation of those affected by serious crime. We will continue to use the Gangs Matrix in our work to bring safety to communities.
He added: "We welcome the independent scrutiny of the Information Commissioner's Office and accept the Enforcement Notice issued against the Met for Data Protection Act breaches with regard to the Gangs Matrix. We have already started work to ensure that we improve our data handling and information sharing with partners, who are also involved in community safety work. As well as addressing the concerns within the ICO report, we are also taking forward additional work including the introduction of a public-facing website to explain the legal framework for the previous Gangs Matrix and further information to improve public confidence and transparency. We have a constructive relationship with the ICO and will continue to work with them as we go forward."
Joint Council for the Welfare of Immigrants files judicial review
EHRC also flags up need for more data on impact of remote hearings
The CEO of Danish tech firm NetCompany tells PublicTechnology why the country’s existing digital infrastructure could help encourage adoption of its soon-to-launch coronavirus...
CMA says that all of society will lose out ‘if the market power of these firms goes unchecked’
PublicTechnology talks to Rich Turner about why organisations need to adopt a ‘risk-based approach’ to security – but first make sure they get the basics right
CyberArk's David Higgins explores the cyber risks of hiring independent contractors
CyberArk's John Hurst looks at the true cost of GDPR breaches