South Yorkshire Police reprimanded by ICO over body-worn video evidence

The issues involved included delaying the formulation of IT back-up policies and not escalating to senior management when flaws were discovered in 2019, poor record keeping (meaning that the force couldn’t confirm how many pieces of footage were permanently lost) and not identifying the security risk in relation to transferring personal data between IT systems.

Sally Anne Poole, head of investigations at the ICO, explained: “This incident highlights the importance of having detailed policies and procedures in place to mitigate against the loss of evidence. People rightly have high expectations that our police forces and services, which protect us, also protect the personal information they hold. There is a lot to be learned from this incident and I encourage police forces and services and other organisation using this type of technology to check and make improvements where they find potential flaws.”

Central hub

At the end of each shift, officers’ body-worn video footage was uploaded and stored to a central hub which could be accessed and managed – along with all of South Yorkshire Police’s digital evidence – via a secure system.

Following an upgrade in May 2023, the secure system began to struggle processing body-worn video data and a local drive ‘workaround’ was then put in place.  

In August 2023, South Yorkshire Police identified that its body-worn video file storage was very low. Further investigation found that some 96,174 pieces of original footage had been deleted from the system.

The following month, it was discovered that the deletion had taken place on 26 July 2023 and included the loss of data relating to 126 criminal cases. Only three of the cases were impacted by the data loss.

Of those three cases, South Yorkshire Police asserts that one may have progressed to the first court hearing if body-worn video evidence had been available. However, as there was no additional independent evidence to prove the offence, progression to prosecution stage was already uncertain.

Prior to the deletion, 95,033 pieces of body-worn video footage had been copied to a new system that South Yorkshire Police was implementing but, due to poor record keeping, the force remains unable to confirm the exact number of files deleted without copies having been made.

Recommended actions

The ICO harbours a dual role of being an enforcer and an educator. In issuing the reprimand, the organisation has set out a number of actions that it recommends South Yorkshire Police should take. These are as follows:

*ensure there is an adequate storage back-up solution and process to restore lost body-worn video footage 

*continue to shadow third parties when accessing South Yorkshire Police IT systems 

*define third party roles and responsibilities when processing personal information held on South Yorkshire Police IT systems 

*complete a risk assessment to determine security implications and control requirements prior to permitting third party access to South Yorkshire Police IT systems 

*ensure all records are marked in a clear and identifiable way

The ICO is keen to point out that these recommendations should also act as prompts to all police forces and services who use body-worn video to check and improve, where necessary, their data protection practices.