Surrey Police, Amazon and the Data Protection act

Been extremely busy the past few months, hence no new posts. However recently I received some interesting emails which I would like to share.

Back on the 29th March I received an email from Surrey Police (out of the blue, thankfully I don’t have an communication with the Police), it read:

Dear Sir or Madam
The Surrey police have recovered a NIKON D3100 camera fitted with a 18 to 55 mm lens that was sold by then stolen from the purchaser. Your details have been obtained as purchasing such a camera from during the relevant period. If you have had your NIKON D3100 camera stolen it maybe the camera that Surrey police have recovered could be yours.
If you have had such a camera stolen please contact Detective constable XXX PXXX XXXXr to establish if the recovered camera is yours.
When replying to this email please include a daytime telephone number so the you can be contacted by Detective constable XXX PXXX XXXXr.
Many thanks”

Nothing wrong with this, yes I have purchased this camera and very nice it is too. Thankfully I have not been the victim of said item being stolen. So why am I sharing this, well…. Surrey Police decided, and this is what troubled me, that they would CC everyone else in the surrounding area (quite a large area as I do not live in Surrey county). So I have a list of valid email addresses of people in and around Surrey have have purchased this camera (and all those people, in turn, have my email). Thanks Surrey Police!

The data protection act does not seem to apply to Surrey Police.

Anyway, before I could anything about it (I read the email at work and thought I would deal with it at home), that evening I received a further email from Surrey Police:

Earlier today I sent out a group e-mail as part of an on-going investigation by Surrey Police into stolen goods including a NIKON camera.
The aim of the e-mail was to identify and reunite the owner of the camera with their stolen item and as a result this has now been achieved.
The e-mail was sent to a list of individuals identified to Surrey Police by Amazon as potential purchasers of the camera.
These email addresses were provided to us in confidence for the purposes of the investigation and were not intended to be shared with each other. This was done in error and I apologise for any concern or inconvenience this has caused.
This information will not be shared with any other parties. 
Your assistance in our on-going investigation is much appreciated.
This made me smile, although I do wonder how many people complained before they took this seriously. Further to that, I do wonder how much trouble the dectective was in for doing this.
Then things became even more interesting (i.e. the plot thickened), on the 30th March I received an email from Amazon!

We’re writing to you about the e-mail you received from Surrey Police.

We wanted to reassure you that this isn’t a “phishing” e-mail, and was sent by Surrey Police as part of an ongoing investigation to return a stolen Nikon camera. was legally required to disclose your contact information to Surrey Police following a Court Order. Disclosure was in accordance with our Privacy Notice and was required by law. Please note that no other information, such as your purchase history and payment information, was disclosed to the Police.

The e-mail that was sent by the Police shouldn’t have had customers’ e-mail addresses visible in the “to” section. We understand that Surrey Police have also sent a subsequent e-mail with an apology. We’re sorry for any inconvenience or concern caused by this.

We’ve contacted Surrey police, who advise that they’re satisfied with the information they’ve received from customers, and we’ve been advised you won’t receive further contact from them regarding this investigation.”

Interesting? So Surrey Police issue a Court Order to get all these email addresses, then shared them with everyone, which in turn created (one guesses) complaints to Surrey Police and Amazon requiring emails of apology. What troubles me, is I brought my camera sometime ago (back July 2011). surely if I had had this stolen from me, won’t I either have claimed it on my insurance (if I had insurance).
I wonder, and I suppose I could find out, what the request (via the court order) was to Amazon. Perhaps it was “Can we have every email address of everyone in the South East of England who brought this camera so we can share it amongst them all”?
Quite fitting, considering the UK government / Police want to pass new laws allowing them more rights to this sort of information (I suppose it will save costs on court orders, and perhaps the Police might want to consider comodotising the information they get…)

Tags: , ,

One Response to “Surrey Police, Amazon and the Data Protection act”

  1. Kali Stage Says:

    Awesome blog.Really looking forward to read more.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: