A PSNI officer has received a final written warning after a serious data breach was uncovered by Police Ombudsman investigators.

A USB memory stick containing the entire contents of a missing person's laptop, including sensitive information like bank details and legal documents, was discovered at the officer's home.

The discovery was made in May 2022 during a search by investigators, who were arresting the officer in connection with an unrelated criminal offence. Forensic examination of the recovered USB sticks found that one contained a complete backup of a laptop belonging to an elderly missing person. The officer had seized this computer in January 2019 while working on the related missing person investigation.

Hugh Hume, the Police Ombudsman's Chief Executive, described the officer's actions as a serious breach of police procedures.

"While the officer used some of the information to assist police efforts to locate the laptop's owner, it is frankly shocking that the entire contents of the laptop were found on an unsecured USB stick in the officer's home three years after he ceased to have any involvement in the case," Mr Hume said. The investigation found that the officer had bypassed the laptop's security and downloaded its entire contents using privately obtained software and USB sticks, instead of submitting the device to the PSNI's Cyber Crime Centre as required by policy.

Further analysis showed that two days after seizing the laptop on Thursday, 8 January 2019, it was switched on, a USB stick was inserted, and a new user account was created. On Monday, 13 January 2019, the passwords were changed and the entire computer was copied to a memory stick. The officer then used information from the computer the following day to make an enquiry.

The officer also took 36 days to lodge the seized laptop in the PSNI property store, making no record of its location during that time.

The Police Ombudsman submitted a file for gross misconduct, which the PSNI accepted. At the subsequent hearing, the officer claimed he was genuinely concerned for the missing person's welfare and bypassed the official system to avoid delay, adding he thought the data had been removed from the USB stick.

While the misconduct panel accepted his concern, it noted his actions were "deliberate… and had continued for a number of days". The panel concluded he had committed gross misconduct for: failing to respect the right to private and family life, failing to store property appropriately, and acting in a way likely to bring discredit to the police service.

The panel determined that a Final Written Warning was the appropriate sanction. The Police Ombudsman's Office has also shared its findings with the Information Commissioner's Office to inform their oversight in this area.