Police in South Yorkshire erase 96,000 pieces of digital proof
The UK's Information Commissioner's Office (ICO) has reprimanded South Yorkshire Police (SYP) for deleting 96,000 pieces of evidence from officers' bodycams, following a "mass deletion of data" that took place on July 26, 2023, during data transfer activities from local storage to a "Storage Grid" platform.
According to the ICO, this data loss affected 126 criminal cases, but only three were directly impacted. One of the impacted cases might have progressed to a first court hearing if body-worn video footage had been available. The ICO stated that SYP has not provided a definitive explanation for the deletion.
Sally Anne Poole, head of investigations at the ICO, emphasized the importance of having detailed policies and procedures in place to prevent the loss of critical evidence. She also highlighted the importance of police forces and services protecting the personal information they hold, as people rightly have high expectations that they do so.
In response to the incident, Poole encouraged police forces, services, and other organizations using this type of technology to check and make improvements where they find potential flaws. She stated that there is a lot to be learned from this incident.
The evidence was stored on a local disk on the force's application server due to issues with the centralized Digital Evidence Management (DEMS) system. Although 95,033 pieces of that BWV footage had already been copied from the Storage Grid to a new system (Digital Asset Management System), SYP's poor record keeping means it can't confirm exactly how many files were deleted without copies made.
The ICO has made several recommendations to SYP to prevent such incidents in the future. These include ensuring there is an adequate storage backup solution and process to restore lost body-worn video footage, completing a risk assessment to determine security implications and control requirements before allowing third-party access to its IT systems, and defining third-party roles and responsibilities when processing personal information held on SYP IT systems.
The ICO also recommended that all records are marked in a clear, identifiable way and that SYP continues to shadow third parties when accessing SYP IT systems. Poole further stressed the need for SYP to ensure that they have detailed policies and procedures in place to prevent the loss of critical evidence.
SYP believes the deleted body-worn video (BWV) footage was deleted from the Storage Grid in error. However, the ICO has stated that more needs to be done to prevent such incidents and ensure the protection of evidence in the future.
