Police apology after staff data sent to G4S
Three police forces have apologised to more than 1,000 staff after accidentally sending their personal details to a private security firm.
Cambridgeshire, Bedfordshire and Hertfordshire forces said the breach happened during negotiations to outsource their office services to G4S.
But the deal with the security firm collapsed. The forces could be punished under the Data Protection Act.
The Information Commissioner's Office (ICO) said it would investigate.
David Craig from the union Unison said: "Many of the members of staff affected are understandably angry and will be reviewing their individual position following any determination by the ICO at the appropriate time."
G4S said all files had been deleted.
'No hard copies'
In a statement, the three forces said five files were sent electronically from their base at Stevenage police station in Hertfordshire a few months ago while they looked at a plan to outsource IT and support services to G4S.
It said the data sent went "over and above" what was required, breaching the Data Protection Act 1998.
Once the breach was identified, the forces said G4S appointed an information assurance professional to ensure that all information relating to the personal data was deleted from their hard drives and records, and that no hard copies existed.
Deputy Chief Constable John Feavyour of Cambridgeshire Police said: "The three forces acknowledged, in their letter to the Information Commissioner, that the sharing of the information was not fair and proportionate.
"However, the non-disclosure agreement in place between the three police forces and G4S ensured that no data left the four organisations involved.
"I wrote to the members of staff affected by this data security breach in February explaining what had occurred and apologised to them.
"G4S responded extremely promptly and professionally when this matter was raised with them, ensuring that all personal data was deleted."
An ICO spokesman said: "We have been made aware of a possible data breach which may involve Cambridgeshire, Bedfordshire and Hertfordshire Police.
"We will be making inquiries into the circumstances of the alleged breach of the Data Protection Act before deciding what action, if any, needs to be taken."