South Yorkshire Police Erases 96,000 Pieces of Digital Proof

The UK's data protection regulator, the Information Commissioner's Office (ICO), has reprimanded South Yorkshire Police (SYP) for deleting 96,000 pieces of evidence from officers' bodycams, affecting 126 criminal cases.

On August 7, 2023, an IT manager at SYP identified a large number of missing files, totalling 96,174. The data, which included body-worn video (BWV) footage, had been temporarily stored on a local disk on the force's application server. The mass deletion of data took place on July 26, 2023, during data transfer activities from local storage to a "Storage Grid" platform by a third party.

The ICO has recommended that SYP completes a risk assessment to determine security implications and control requirements before allowing third-party access to their IT systems. The regulator also urged the police force to ensure an adequate storage backup solution and process to restore lost BWV footage.

Further issues with a backup solution, which were not resolved despite being known about since 2019, meant there were no fallback measures. As a result, only three of the 126 criminal cases were directly impacted, and of these, only one might have progressed to a first court hearing if BWV had been available.

Sally Anne Poole, head of investigations at the ICO, emphasized the importance of having "detailed policies and procedures in place" to prevent the loss of critical evidence. She also urged police forces, services, and other organizations using similar technology to check and make improvements where they find potential flaws.

The ICO has also recommended that SYP defines third-party roles and responsibilities when processing personal information held on their IT systems. Additionally, the regulator has suggested that the police force ensures all records are marked in a clear, identifiable way.

SYP has not been able to provide a definitive explanation as to how the deletion occurred. However, although 95,033 pieces of BWV footage had already been copied from the Storage Grid to a new system (Digital Asset Management System), SYP's poor record keeping means it can't confirm exactly how many files were deleted without copies made.

The ICO has recommended that South Yorkshire Police continues to shadow third parties when accessing their IT systems to prevent such incidents in the future. This incident serves as a reminder of the importance of robust data management practices and the potential consequences of data loss in criminal investigations.