A 2024 reprimand issued by the UK Information Commissioner’s Office (ICO) to the Police Service of Northern Ireland (PSNI) serves as a stark reminder that even well-resourced organisations can fall foul of the UK GDPR when basic controls around data handling and publication are not properly enforced. The incident involved the accidental online disclosure of personal data relating to PSNI officers and staff, with serious and lasting consequences.
What happened?
In August 2023, PSNI published a spreadsheet online in response to a Freedom of Information request.
The document contained the personal data of approximately 9,500 officers and staff, including names, ranks, roles and workplace locations.
The information was accessible to the public for several hours before being taken down.
The ICO’s investigation found that the disclosure resulted from inadequate internal checks before publication.
Given PSNI’s status as a law enforcement body, the risk posed to affected individuals was exceptionally high, even though the breach itself was short-lived. [1]
Why was this a problem?
The data was published in bulk, without sufficient review or redaction, exposing individuals to potential harm.
There was an over-reliance on manual processes, without appropriate safeguards to prevent human error.
The organisation failed to apply effective controls to ensure personal data was removed before disclosure.
Given the nature of PSNI’s work, the consequences of exposure were far more serious than in many other sectors.
These failings fell short of the requirements under Articles 5(1)(f) and 32 UK GDPR, which require integrity, confidentiality and appropriate security measures.
What does it mean for your organisation?
This case highlights that data breaches do not always stem from sophisticated cyberattacks. Sometimes, the most damaging incidents arise from routine tasks carried out without adequate oversight. Publishing information externally, whether via FOI responses, websites, or shared portals, is a high-risk activity that demands robust controls.
Importantly, regulators assess risk in context. Where the potential harm to individuals is high, expectations around diligence and safeguards increase accordingly.
To avoid similar pitfalls, organisations must:
Implement mandatory review and sign-off processes before any external publication of data.
Apply data minimisation rigorously: only disclose what is strictly necessary.
Use technical controls to support manual checks, such as automated redaction tools.
Train staff regularly on handling disclosures, FOIs, data subject access request responses (SAR), and public-facing information.
Take a risk-based approach to security, recognising when the nature of the data elevates the stakes.
The takeaway? Large‑scale harm does not require complex attacks; a single unchecked human error in a routine process can be enough to cause it.
Tales from the coalface
Each month, we examine Data Protection issues encountered by our clients. This month, we focus on website banners, consent management tools, and cookies. These remain one of the most visible aspects of GDPR compliance. What starts as an attempt to meet ePrivacy and GDPR obligations often turns into a compliance liability through poor design, misleading messaging, or reliance on inadequate tools.
In our client work, we see the same patterns repeatedly: banners that nudge users towards consent rather than choice, consent management tools that fail basic functionality tests, and cookie practices that ignore signals from regulators and enforcement actions.
Not All Banners Are Created Equal
A compliant banner informs and empowers, but many of which we audit do the opposite. Common issues include:
Dark patterns and manipulative design: "Accept All" buttons dwarfed by tiny "Reject All" links, or banners that pre‑tick boxes for non‑essential cookies. These practices undermine freely given consent under both GDPR Article 4(11) and ePrivacy rules.
Inadequate granularity: Bundling trackers, marketing cookies, and analytics into a single "necessary" category, making it impossible for users to refuse non‑essential processing without breaking site functionality.
Broken reject flows: Users who select "reject" are either forced to search for a settings page or hit a paywall, which courts and regulators increasingly view as consent invalidation.
Zombie cookies: Third‑party trackers that respawn despite user refusal, often due to poor consent management tool configuration or unmonitored vendor scripts.
What’s the risk of non-compliant banners and consent management tools?
Reprimands: Just accessing your website can be unlawful if there is no cookie consent or if it is invalid, exposing you to complaints before the supervisory authority, and potential fines and corrective orders.
Trust and image: A pushy or confusing banner signals that privacy is an afterthought, quietly damaging your organisation's credibility with customers and partners.
Wasted marketing: If consent is not valid, your analytics and ad data are unreliable, so you may waste money on campaigns you cannot properly measure.
Distraction from the core business: Fixing cookie issues after a complaint can consume time that should be spent on serving customers.
Why does it happen?
Limited resources mean privacy compliance is often disregarded.
Heavy reliance on third-party marketing vendors without proper privacy oversight.
Cookie banners and consent management tools are implemented once and rarely reviewed or updated.
Default consent tool settings are used without proper configuration.
Marketing needs are over-prioritised over compliance concerns.
How to fix it:
True compliance requires technical rigour, user‑centric design, and ongoing vigilance:
Audit your stack: Run a simple scan (via your consent tool or an online scanner) to list every cookie, script, and tracker on your site. Classify them as strictly necessary (first‑party, functional) or non‑essential (analytics, advertising, social, etc).
Design for real choice: Your banner should give “Accept all” and “Reject all” equal prominence and the same number of clicks. Add clear toggles per category and an easy way for users to change their mind later via an always visible icon or footer link.
Check your consent tool fits your size: Make sure it lets you switch categories on and off easily (e.g. necessary, analytics, advertising) and actually blocks non-essential tools until consent is given. Avoid overly complex setups that you cannot maintain.
A privacy‑compliant website is more than a tick‑box exercise; it is a visible sign that your organisation takes consent and user choice seriously. A clumsy banner or unreliable consent management tool, on the other hand, sends a clear message of weak governance to customers and regulators.
If your organisation needs help auditing your website, Ambit Compliance can assist. Do not hesitate to contact us at info@ambitcompliance.ie and check further about us on our website https://www.ambitcompliance.ie/.
Contributors to this blog: Gillian Traynor, Dwayne Morgan, and Facundo Heredia.
