The ICO has served the Met Police with an enforcement notice after an officer handed a stalking suspect unredacted documents carrying the victim's new address and phone number. The suspect used the number to contact her.

The regulator found the officer and their manager had not done data protection training in over four years, and completion rates across the force were low.

A training module nobody finishes is not a control. The ICO has given the Met twelve months to get completion to 100%, which tells you where the failure actually sat.