Met Police ordered to improve data protection after stalking and honeytrap breaches
Information Commissioner’s Office issues enforcement notice following two incidents exposing victims’ details
News London evidence indexOpen analysis ▾
Trust score 68 due to named ICO source and quoted statement, but lacking multiple independent outlets.
Higher is stronger
Critic score 87 for clear relevance, specific quotes, facts, and coherent narrative with minimal editorializing.
Higher is stronger
Hype score 30; language is measured with mild emphasis, no clickbait or sensational framing.
Lower is better
The Metropolitan Police must urgently overhaul its data protection policies after the Information Commissioner’s Office found serious failings in two cases. The breaches exposed a stalking victim’s new contact details to the defendant and revealed the email addresses of 18 people connected to Parliament.
In the first case, a police officer sent the defendant in a stalking protection order case the victim’s new address and phone number. The victim had already moved and changed her number to avoid contact. The defendant later called her on the new number, saying he had received the details from police.
Two arrested in Barnet-linked £200,000 benefits fraud raid
Police and DWP investigators seized luxury goods during searches in Ealing and Harrow as part of Operation Sendara
The same officer also sent the names and contact details of three witnesses to the defendant. The ICO said the Met’s policies were weak and had serious shortcomings. One officer involved had not completed data protection training for more than four years.
Westminster honeytrap case exposed email addresses
In the second incident, the Met emailed 18 people linked to Parliament to inform them of a change to a suspect’s bail date in the Westminster honeytrap case. The force failed to use blind-copying, meaning all recipients could see each other’s email addresses.
Stabbing in Chingford Mount leaves 24-year-old man injured
Metropolitan Police confirm no arrests made after incident on Brook Crescent on 4 August 2026
The ICO said this could allow highly sensitive information to be inferred about the recipients, even though the email itself did not contain explicit details. The case involves former Conservative MP William Wragg, who resigned the Tory whip in April 2024 after admitting sharing MPs’ phone numbers.
Oliver Steadman, 29, from Islington, has pleaded not guilty to blackmail and improper use of a public electronic communications network. His trial is scheduled for October 2027.
ICO demands action within three months
The ICO issued a reprimand and enforcement notice, requiring the Met to take action within three months. Jo Stones, the ICO’s group manager for civil and cyber investigations, said the incidents were foreseeable and preventable.
People entrust the police with some of their most sensitive personal information, often at moments when they are vulnerable or at risk. They have the right to expect that information will be handled securely.
Jo Stones, ICO group manager for civil and cyber investigations
Stones added that the Met failed to put in place safeguards to protect personal information. The ICO said policies and reminders were not enough if they were not followed, checked and enforced. The Met has been contacted for comment but has not yet responded.
What happens next
The Metropolitan Police must comply with the ICO’s enforcement notice within three months. The force has already taken some steps, including informing those affected and issuing reminders to staff. The ICO will monitor progress.
Questions this report answers
+What did the Met Police do wrong in the stalking case?
A Met Police officer sent a stalking victim’s new address and phone number to the defendant, forcing her to move and change her number again. The officer also shared the contact details of three witnesses with the defendant. The ICO called the breaches foreseeable and preventable.
+How many people were affected in the Westminster honeytrap case?
Eighteen people linked to Parliament had their email addresses exposed when the Met failed to blind-copy recipients in an email. The ICO said this could allow sensitive information to be inferred about them, even though the email did not contain explicit details.
+What is the Met Police required to do now?
The Information Commissioner’s Office issued an enforcement notice, requiring the Met to improve its data protection policies within three months. The force must also ensure staff training is up to date and policies are enforced.
+Who is Oliver Steadman and what is he accused of?
Oliver Steadman, 29, from Islington, is accused of blackmail and improper use of a public electronic communications network in the Westminster honeytrap case. He has pleaded not guilty, and his trial is scheduled for October 2027.
News London Desk
This article was written at the News London news desk from the reporting of the outlets listed below it. Drafting is done by a language model under human editorial supervision — there is no reporter behind this byline, and we would rather say so than invent one.
How stories are produced and scoredWho runs News LondonCorrections
The London Ledger
A considered capital-wide edit delivered each morning.
More Coverage in Crime & Safety
Two arrested in Barnet-linked £200,000 benefits fraud raid
Stabbing in Chingford Mount leaves 24-year-old man injured
Met firearms officer cleared of misconduct after four-year inquiry
