The Metropolitan Police has been supplied with the phone records of some 1,700 News UK employees after a mistake by Vodafone.
Staff have been told that the records relate to staff using company mobile phones between 2005 and 2007.
So most journalists working on The Sun, Times and Sunday Times are likely to have been affected. The age of the data means that dozens of journalists working on the now defunct News of the World would have had their telecoms data mistakenly disclosed to the Met Police and apparently unlawfully accessed.
According to an email from News UK chief executive Mike Darcey the data, held by the company's main telecoms provider Vodafone, was "inadvertently disclosed by them to the Metropolitan Police Service last February in response to a specific request under the Regulation of Investigatory Powers Act".
The data will include details of numbers called by staff members, and calls received, so could compromise confidential journalistic sources.
The request was made by officers from Operation Elveden, the investigation into payments by journalists to public officials, and – according to Darcey – they were seeking details of the outgoing calls made by one member of staff.
The Met Police (MPS) has apparently made wider use of the information even though it was disclosed accidently and there are strict guidelines in place to stop "collateral intrusion" when it comes to RIPA requests.
Darcey said: "The MPS has told us that the data was searched with respect to 4 current/former employees who have been informed of this."
According to The Times, despite the fact the Met had no right to have the material it placed details of the calls made by 1,757 phones in a spreadsheet for analysis.
The "excess" data was held on to by the Met for seven months and only returned to Vodafone on 17 October.
A Vodafone spokesman told The Times: “We wrote to the Met to express our grave concern that the police continued to retain the data released to them in error and made it clear to them that any assumption that meaningful conclusions could be drawn from any aspect of the corrupted dataset was highly questionable.”
The Met Police has already faced questions in Parliament and widespread criticism after the revelation it used RIPA to view the phone records of Sun political editor Tom Newton Dunn and the Sun newsdesk to track down confidentional police sources on the Plebgate affair.
This latest development is likely to increase calls for urgent reform of the Regulation of Investigatory Powers Act to ensure journalists and their sources are given better protection.
The RIPA request to Vodafone which caused this mistake would have been signed off internally by the Met Police and in secret without any notice being given to News UK.
Darcey said in his email:
A senior Vodafone executive has personally apologised to me for what he insists was “human error”. Vodafone accepts that the data was “wrongly disclosed” and that our trust and confidence in them have been badly damaged. They also recognise that the mobile phone records of journalists – and lawyers – are particularly sensitive and we have made clear to them that we regard this as a very serious issue. I am personally appalled that this could happen and have relayed this in the strongest terms when speaking with Vodafone.
He revealed that the Interception of Communications Commissioner's Office has conducted an investigation into this incident and referred the matter to the Information Commissioner's Office.
Darcey said: "Our priority – at News UK – was to ensure that Vodafone sought the immediate return of the data from the MPS along with assurances that it had not been wrongly accessed. We also raised the issues directly with the MPS, who have now confirmed to us that they returned all 'excess data' on the 17th of October to Vodafone who continue to hold it."
He said: "I appreciate how alarming the nature and scale of this breach is, and would like to assure you that we have moved swiftly and decisively to minimise its impact to the extent possible, seek assurances for the future and explore what remedies may be available to us."
A spokesman for the Met Police said: “We recognised the sensitivity of the excess data provided and ensured it was retained securely, until it was returned to Vodafone. The Metropolitan Police consulted with the Interception of Communications Commissioner’s Office, and the Information Commissioner on how this error should best be managed.
“The Met agreed that it would only use the material for a policing purpose, when in the interests of justice to do so, and where people were already charged and facing criminal proceedings.”
Email pged@pressgazette.co.uk to point out mistakes, provide story tips or send in a letter for publication on our "Letters Page" blog
