UUP Questions Details Of 6th July Theft Of Police Data

The Ulster Unionist Party has called on PSNI Chief Constable, Simon Byrne, to clarify information on a 6th July theft of personal police officer information.

A spreadsheet, containing the personal details of some 200 officers and police staff, a police laptop and radio, were stolen from an officers personal vehicle in the Newtownabbey area.

UUP representative on the Policing Board, Mike Nesbitt MLA, has written to the Chief Constable, questioning the statement the PSNI released concerning the theft.

Mike Nesbitt said: "The timelines in the statement do not make sense to me. They need interrogation and I intend to do so at the next session between the Chief Constable and the Policing Board. I have four areas for clarification. First, why did it take three weeks for senior officers at Headquarters to become aware? It’s not the first time in recent times there has been an undue delay between an adverse event and the information reaching the Senior Executive Team. That suggests a systemic failure that needs addressed urgently.

"Secondly, I am concerned it took HQ 8 days to alert the 200 officers and staff that a data sheet containing their names had been stolen. The PSNI say they had to confirm the exact nature of the missing data. I would have thought all they had to do was ask the officer whose car was broken into to identify the data set. I cannot speak for the 200, but if I was one of them, I would be extremely angry I was allowed to go about my daily life for over a week before being told some of my personal details had been stolen.

"Thirdly, why was there a 4 day delay in alerting the Information Commissioner? The PSNI statement says they wanted to be sure that "accurate information" was passed to the Commission Office. Yet, Section 67 of the Data Protection Act 2018 says a breach should be reported "without undue delay" and "where feasible not later than 72 hours after becoming aware of it". That is three days, not four. I would have thought it would have been best practise to alert the Commissioner as soon as HQ became aware on 27 July, if only to inform him of the headline fact of the theft, with a promise to revert once full detail was established.

"The most puzzling aspect is the lack of clarity about when exactly they deactivated remotely the missing laptop and radio. The statement mentions the theft on 6 July and suggests the devices were deactivated shortly afterwards. That implies the remedial action took place well before HQ were aware, so who had the authority to order deactivation without informing Headquarters?

"The vagueness is in stark contrast to the pinpoint accuracy the PSNI provided the Board about the timeline of the larger, catastrophic data breach of the 10,000 names. Here, we were informed to the minute, of when the data was uploaded, when the PSNI were alerted to what they had done, and when they informed the Information Commissioner’s Office (that was minutes, not days). 'Shortly afterwards' does not cut it and I have asked the Chief Constable to explain."