The Police Federation of England and Wales (PFEW) was the subject of a ransomware cyber-attack on the 9th March 2019 and the names, email addresses, National Insurance numbers and ranks of around 120,000 Police Officers were exposed. However, the said Police Officers were not informed of this until the 21st March 2019. The PFEW stated to them as follows:
“We are deeply sorry that this has happened and that data we hold about you has been affected and know that this will cause you some concern. We have instructed a leading forensics firm to help us investigate the matter. This is a complex process and will take some time. Indications are that it was not targeted specifically at PFEW and was likely part of a wider campaign. There is also no evidence at this stage that any data was extracted from PFEW’s systems, although this cannot be discounted at this stage. Whilst we consider at this stage the risk of your data being extracted or misused is low, we wanted to alert members as to the risk at the earliest opportunity”.
Even to this day, the PFEW’s investigation into how this happened and to what extent remains ongoing.
Given that there has been an apology provided and confirmation that personal information may have not been adequately and securely protected, affected Police Officers have the recourse to seek compensatory damages.
The affected personal information of Police Officers may have been accessible to an unknown number of parties for an unknown amount of time and the PFEW should have ensured, as data controller, that this personal information was kept safe and secure so that it would not be compromised in accordance with their data protection responsibilities.
By not doing so, PFEW are potentially liable in law as they have possibly lost control of personal information, failed to process the said personal information in a manner than ensures the appropriate security of data in line with GDPR, breached the confidence of affected Police Officers by misusing private information which has also infringed upon their right to privacy of their personal data.
How do I start?
If you are a PFEW member and have received notification that you have been affected by this incident, this is all you need in order to join your colleagues in this group claim. Once you have this, all you then need to do is complete the below contact form and one of our specialist team will then be in touch to get the ball rolling for you.