ICO hits Met Police with enforcement notice over use of Gangs Matrix

The Information Commissioner’s Office has served an enforcement notice against the Metropolitan Police Service after an investigation found that its use of the ‘Gangs Matrix’ database had led to multiple and serious breaches of data protection laws.

The ICO launched its investigation into the Gangs Matrix, which records intelligence related to alleged gang members, in October 2017 after concerns were raised by Amnesty International.

The watchdog said the investigation “found that, whilst there was a valid purpose for the database, the inconsistent way it was being used did not comply with data protection rules”.

The Met Police’s operating model governs the use of the Matrix across the Metropolitan area. Each of the 32 London boroughs operate their own Matrix; these are then compiled centrally to form a larger London-wide Gangs Matrix.

The personal data of people recorded on the Gangs Matrix includes; full names, dates of birth, home addresses, and information on whether someone is a prolific firearms offender or knife carrier.

The ICO found:

• The Gangs Matrix “does not clearly distinguish between the approach to victims of gang-related crime and the perpetrators, leading to confusion amongst those using it”;
• An operating model that was “unclear and inconsistently applied” across the boroughs, with some good practice in some areas but poor practice elsewhere;
• Some boroughs operated informal lists of people who had been removed from the Gangs Matrix, “meaning that the Met Police continued to monitor people even when intelligence had shown that they were no longer active gang members”;
• Excessive processing of data as a result of blanket sharing with third parties that failed to distinguish between those on the Gangs Matrix assessed as high-risk and those as low risk, with the potential for disproportionate action to be taken against people no longer posing a risk;
• Serious breaches of data protection laws “with the potential to cause damage and distress to the disproportionate number of young, black men on the Matrix”;
• The absence of an equality impact assessment that would enable the Met Police to show it had considered in this context the issues of discrimination or equality of opportunity;
• An absence, over several years, of effective central governance, oversight or audit of data processed as part of the Gangs Matrix, "resulting in risk of damage or distress to those on it";
• The absence of information sharing agreements governing the purpose and use of the data by those third parties and insufficient guidance about how the third parties should handle and use the data. “This led to the increased potential for an inconsistent approach and harm to data subjects.”

The ICO revealed that it would also be launching a second investigation that focuses on how partners of the police handle information, such as that provided through the Gangs Matrix, “and is already investigating a data breach at Newham Borough Council involving the Matrix”.

Deputy Information Commissioner of Operations James Dipple-Johnstone said: “Protecting the public from violent crime is an important mission and we recognise the unique challenges the Metropolitan Police Service faces in tackling this.

“Our aim is not to prevent this vital work, nor are we saying that the use of a database in this context is not appropriate; we need to ensure that there are suitable policies and processes in place and that these are followed.

“Clear and rigorous oversight and governance is essential, so the personal data of people on the database is protected and the community can have confidence that their information is being used in an appropriate way.”

The enforcement notice requires the Met Police to take steps to ensure the Gangs Matrix complies with data protection laws, which the ICO said includes:

• Improving guidance to explain what constitutes a gang member and the intelligence required to demonstrate gang membership;
• Ensuring people’s data on the Gangs Matrix is clearly identified, to distinguish between victims of crime and actual or suspected offenders;
• Erasing any informal lists of people who no longer meet the Gangs Matrix criteria;
• Developing guidance in relation to the use of social media as a source of ‘verifiable intelligence’;
• Ensuring that any Gangs Matrix information shared with partner agencies is done so securely and proportionately; and
• Conducting a data protection impact assessment (DPIA) of the Gangs Matrix.

The ICO said that the Met Police already has an action plan underway and had stopped sharing personal data on the Gangs Matrix with third parties, where there was no individual sharing agreement in place. It has also committed to being more open about the database and is working with the ICO to complete a DPIA.

Dipple-Johnstone said: “I am pleased that the Met Police has been co-operating with us and has committed to bringing the Gangs Matrix in line with data protection laws, and we will continue to work with them.

“I believe that by taking these steps and demonstrating that people’s data rights matter to them, the Met Police will be able to build increased trust amongst their communities.”

Responding to the ICO’s enforcement notice, Deputy Assistant Commissioner for Met Operations Duncan Ball said: "The Gangs Matrix is an intelligence tool that the Met uses to reduce the impact of gang violence on the communities of London. It is designed to assist us in effectively targeting violent offenders and prevent victimisation of those affected by serious crime. We will continue to use the Gangs Matrix in our work to bring safety to communities.

"We welcome the independent scrutiny of the Information Commissioner's Office and accept the Enforcement Notice issued against the Met for Data Protection Act breaches with regard to the Gangs Matrix. We have already started work to ensure that we improve our data handling and information sharing with partners, who are also involved in community safety work.

"As well as addressing the concerns within the ICO report, we are also taking forward additional work including the introduction of a public facing website to explain the legal framework for the Gangs Matrix and further information to improve public confidence and transparency. We have a constructive relationship with the ICO and will continue to work with them as we go forward."

The ICO said that due to the timing of the case, it was dealt with under the provisions of the Data Protection Act 1998, and not the General Data Protection Regulation (GDPR) and 2018 Act that replaced it in May this year.