The UK's Information Commissioner's Office (ICO) has reprimanded and issued an enforcement notice against London's Metropolitan Police Service (MPS) following two data breaches in 2024, one of which saw officers hand a stalking victim's new address and phone number to her stalker. The ICO said the failures were not isolated incidents but reflected broader weaknesses in the force's policies and procedures for handling sensitive personal data, and it has ordered the MPS to take specific corrective steps.

In the first incident, officers failed to redact witness statements and other documents shared with a man subject to an interim Stalking Protection Order, exposing the new address and phone number of his victim, who had already relocated because of his behaviour, along with details of her friends and family. The man, who had breached bail conditions by fleeing the UK, contacted the victim on her new number within days; he was later arrested, charged with stalking and jailed after pleading guilty. The second incident involved an email sent to 18 people linked to a parliamentary honeytrap operation using CC instead of BCC, exposing their addresses to one another; the ICO also found the officer responsible, and their manager, had not completed data protection training for around four years, reflecting force-wide low training completion rates the MPS has now pledged to improve.