A case which I have recently concluded on behalf of one of my clients, whom I shall identify for the purposes of this blog by the pseudonym Catherine, centred around one of the most shocking ‘bureaucratic errors’ that I have ever encountered: the release by both the Police and the Crown Prosecution Service of a rape victim’s personal data to her attacker.
Owing to the need to entirely protect my client’s anonymity, I will restrict the details provided to a minimum.
Catherine was the victim of a serious sexual assault (stranger rape) which was subsequently investigated by her local Police Force, and shortly thereafter, the perpetrator of the rape, a man whom I shall identify as “D” was arrested and remanded into custody.
Thereafter, an unredacted bundle of evidence, which had been assembled by the Police, was disclosed by the CPS to D (who was being held on remand in prison). Included amongst this disclosure was Catherine’s full name and home address.
On discovering this ‘mistake’, the Police made contact with Catherine, although they didn’t initially admit their own instrumental role in what had happened, merely telling Catherine that “somehow” her name and address had been disclosed to her attacker. The Police then sought to alleviate concerns as to Catherine’s personal safety by fitting an emergency alarm at her home address (where she lived with her mother and younger siblings) and also giving her a ‘rape alarm’ device to carry around with her; however, she was so shaken and disturbed by this revelation that she actually crashed her car on the way home from work the following day, fortunately avoiding serious injury.
Then, only weeks later, Officers came to visit Catherine at her place of work to give her further information about the disclosure of her sensitive personal data; Catherine was now told that D had written a letter to the Police, telling them that he was in possession of these documents, and making abusive comments about her – which had prompted a search of his cell, and recovery of the documents.
In the months following the rape Catherine had been trying to get her life back to normality; however, these data breach revelations set back her recovery significantly, by causing her terrible concern about the safety of herself and her family. Although D was in custody, Catherine feared that he could have passed on information to someone outside of prison and that they might seek to intimidate and/or assault her and her family, in the run-up to the trial (in which D was pleading not guilty). She felt as though a “bombshell” had gone off in her life and that she could no longer trust the Police to fully protect her; indeed, she felt that they had ‘exposed’ her and given the rapist control back over her.
The Police were blaming the CPS lawyers, and vice versa; Catherine felt that she couldn’t trust anyone and began to suffer flashbacks to the rape, and recurrent dreams in which she was being threatened. Furthermore, as a direct result of the risk which the Police now believed her to be in, Catherine and her family had to hastily relocate to another address, leaving behind the family home in which she had grown up.
In other words, what the Police and CPS had done, had stripped away the security and comfort of the one refuge where she should have been able to feel entirely safe and protected – her family home – and turned it from being a place of healing into a place of danger where her attacker might be able to find her, either now or in the future. The only way to resolve this risk was therefore the massive upheaval of Catherine and all of her family moving to a different location, in circumstances which Catherine and her mother were reluctant to fully explain to Catherine’s younger siblings.
Of course, this bricks- and- mortar relocation could not in itself alleviate Catherine’s concerns for her safety, given the details which her attacker had been made privy to about her; and all of this added massively to the stress which burdens any rape victim who is facing the tortuous criminal trial to try to ensure that her attacker stays behind bars. Catherine felt anxious and panicky most of the time, unable to relax at home (even in the new house) and frequently checking that doors and windows were secure.
Just over a year after Catherine’s rape, D was convicted of that offence, having changed his plea to guilty a day before the trial. He received a mandatory life sentence, though Catherine knew that was not a guarantee he would never be released – and she continued to fear that he could track her down and harm her by means of an associate outside of prison.
The combined effect of these events led to Catherine having to seek psychiatric treatment, and to suffer so much stress that she quit her job, experiencing a (thankfully temporary) period of unemployment. Thereafter, she found herself having to embark on a new career in a different, and less satisfying line of employment.
The Data Breach Claim
I received instructions from Catherine to bring a claim against both the Police and the CPS. This was on the basis that the unredacted evidential material containing Catherne’s personal information, had been first assembled by the Police and then disclosed to D by the CPS (via D’s criminal defence solicitors).
Receiving no formal response from either proposed defendant to the letters of claim, I had no choice but to institute court proceedings on behalf of Catherine in November 2019.
Sadly, neither the Police nor the CPS took the right step of promptly admitting liability; Catherine throughout this ordeal had done all she could to help herself get back to normal – including forging a new career after her break-down, in which she was now prospering – but the Police and the CPS having created this huge burden on her shoulders in the first place, then compounded their wrongdoing by disputing her claim for compensation. Rather than those two organisations, who are such close partners in the criminal justice system, putting their heads together to settle the claim, they denied liability individually – each disputing that they actually owed Catherine a duty of care or that what they had done gave her any right to compensation under the Data Protection Act – and argued that in the alternative, it was the other organisation who was to blame.
Thus Catherine was now put through the additional stress of another contested court case, in which she had to repeatedly give evidence and talk about the impact the data breach had had upon her life after the rape, including undergoing psychiatric examinations by both her own medical expert and one appointed by the Police/CPS; once more re-opening the mental wounds/ trauma of these events. To make matters worse, the medical report of the Police/ CPS psychiatrist was only disclosed at an extremely late stage, in breach of the Court directions timetable, putting the trial itself in jeopardy and only increasing the stress and worry of the litigation process for Catherine. Such conduct by the Defendants frankly smacked of a lackadaisical attitude and disrespect towards both Catherine and the Court, especially egregious given the underlying facts of this case.
It was not until late November 2021, after some 2 years of litigation, and only a few weeks before the scheduled trial of the claim that the Defendants settled Catherine’s claim in the sum of £40,000 damages (their initial offer of £24,000 having been quite properly rejected).
In the meantime however, Catherine had been taken once again almost all the way to trial; she had been wronged by major organisational failings whereby the Police and CPS, both of whom owed her a duty of careful handling of the disclosure process, had released her home address to the last person on Earth it should be provided to, and she was wronged by both organisations once again by the manner in which they adopted the approach of callous bean-counters, and dragged out her suffering through the civil court process (largely prolonged, I believe, by their own internal bickering over their respective share of the responsibility) – rather than properly and promptly compensating her for the gross error they had jointly committed.
It sometimes seems too easy for those agencies who run our criminal justice system to overlook the victims of crime; in this case, a victim of crime whom they further victimised by a data breach which was easily avoidable, and which they then contested – adopting the role not of protectors, but adversaries.
Justice was eventually done, but at significant cost to all involved.
Iain Gould - Actions Against the Police Solicitor 
You must be logged in to post a comment.