Records deleted from the Police National Computer – What went wrong?

• by Olivia Lawlor-Blackburn
• Advent IM Blog

The ‘technical issue’ saw fingerprints, DNA and arrest histories wiped after being flagged for deletion. The data was deleted from the Police National Computer – the system that stores criminal records information across the UK and is accessed by front line officers who need real time access for checks on people, crimes, vehicles and whether people are wanted for unsolved offences. After the news came out, the Home Office stated that the data lost was of individuals who had been arrested but later released without any further action, but that is no consolation.

The deletion is said to have occurred when a coding error flagged the records as due to be removed before checks had been carried out to determine if they could be lawfully held or not. It is permissible for the DNA and fingerprints of a person who has not been convicted and has been released without further action, to be held for three years before deletion. However, it is not clear how long the data in questions had been kept for before it was erased.

The data was said to be deleted accidentally during a weekly routine “weeding” session to remove data that was no longer needed. Weeding of data is vital for the upkeep of data integrity, the overall accuracy, completeness and consistency of data is essential, particularly in the example of front line policing. Data integrity will ensure the information held on the PNC is complete, accurate and reliable no matter how long it is stored and accessed. Now, this is good news that the information held on the PNC is routinely checked and removed when necessary, but what happens when there is a mistake? A plan for recovery is essential for ALL organisations that store and manage data. While data integrity ensures information is accurate and intact for the period of time it is intended for, it does not mean data security.

UK Police forces have been hard hit by financial cuts since 2012 and this often hits hardest with the back office services of police forces, in order to preserve front line police services. The Police are set to face their worst ever annual cuts in 2021, fuelled by the covid-19 crisis, so the situation is set to regrettably, get worse.

The UK Government said no details of criminal or dangerous individuals had been deleted. However, it is not clear what really was lost, as little has been said.

There are a number of problems this situation could cause in the future. Although it seems clear that there is regular housekeeping of the information stored on the PNC, a lack of recovery plans and procedures seems the bigger problem in this case. Housekeeping of data is something all organisations who are responsible for holding data need to consider. Poor data management and a lack of planning for errors will mean that this situation could easily occur again. This error comes after the UK also failed to share over 75,000 criminal convictions with the EU in January 2020, where crimes of convicted criminals were not shared, potentially allowing dangerous criminals to return to their home country and pose a risk to the public. EU authorities were not informed of the crimes committed, the sentences given to the nationals by UK courts or the risk the individuals posed to the public due to a ‘error’ on the Police National Computer. The PNC generates daily activity files of the latest updates, and any relating to foreign offenders are meant to be forwarded to the European Criminal Records Information Exchange System by a body known as ACRO Criminal Records Office, responsible for international police data sharing. ARCO rely on the daily updates files from the NPC to send notification messages to other countries in relation to cases. It is unclear why the records were not forwarded from the NPC but following an investigation, a software script had been developed and was released in the next software update schedule.

The Investigatory Powers Commissioner and the Information Commissioner have both, on numerous occasions, expressed concern over the way police forces manage RRD – Review, Retain, Delete.

At a practical level this could affect police processes going forward, the information stored on the PNC is used daily by front line officers who cross check details of possible criminals against previously recorded details on the PNC. This can impact future investigations because DNA, fingerprints and arrest histories that have been removed in error cannot be used to arrest or convict a potential criminal, due to lack of evidence.

Former Cumbria Police Chief Constable said the removal of the data presented a ‘risk to public safety’. The social repercussions that could stem from this could mean individuals are not arrested, not prosecuted for potential crimes already committed, or a failure to see a pattern in a person’s history with the police that could have avoided a future crime.

All organisations need to have a set retention policy for the information they hold. The policy needs to describe how long your organisation needs to keep the data, where it is stored, and once it is time to delete it, a clear plan on how to correctly dispose of the record when it is time.

Information management and review, retain, delete is essential for any organisation with masses of data to manage, which can include health records, recruitment notes, client details and maternity records, for example. If you are not doing that dynamically as part of business as usual, on an ongoing regular basic, it is clear to see how quickly things fall into disrepair and you can end up with a backlog, resulting in a situation similar to this. The police work to multiple layers of retention policies and one size does not fit all. A retention policy is not a set standard and each document an organisation holds may have its own retention policy, for example, interview notes from a potential new employee, need to be stored for 6 months because this is the statutory time frame that a person can dispute that they were unfairly treated during an interview. The police are working against a very complex situation where, depending on the crime, will require the information to be held for a certain number of months or years, depending on its category.

The single greatest threat to a company’s cyber security posture during lockdown was the overall lack of employee training, and this is no different for information security. Whether data loss is due to an outsider attack, or an internal error, organisations need to have a roll back recovery plan as part of their business continuity. It is not enough to scan the horizon for potential issues. Organisations need to be ready to react and efficiently recover as if it is certain they will run into a problem.