Police Issue Apology After Personal Data of Al-Fayed Abuse Complainants Exposed in Email Blunder

British police have issued a formal apology after a significant data protection failure exposed the email addresses of more than 140 people who have come forward with sexual abuse allegations against the late Mohamed Al-Fayed, the former owner of the iconic London department store Harrods.

The breach, which officials attributed to human error, occurred when an email was sent to complainants without concealing recipient addresses from one another. As a result, the personal contact details of 143 individuals — each of whom had made allegations of abuse against Al-Fayed — were inadvertently made visible to all others who received the same message, according to reports.

A Serious Lapse at a Deeply Sensitive Moment

The incident is considered particularly grave given the vulnerable circumstances of those affected. The individuals whose information was exposed had already taken the significant step of reporting alleged abuse, and the unintended disclosure of their identities to fellow complainants represents a serious breach of both privacy and trust. Authorities acknowledged the distress this error was likely to cause and moved swiftly to communicate their regret to those involved.

Al-Fayed, who died in August 2023 at the age of 94, had long been one of Britain’s most prominent and controversial public figures. Following his death, a growing number of women came forward with allegations of sexual abuse spanning several decades, many of them involving encounters at Harrods, where he served as owner for over a quarter of a century. The volume and severity of the accusations prompted widespread media coverage and prompted formal investigations by law enforcement.

Data protection experts noted that the type of error involved — sending a group email with addresses visible in the “To” or “CC” field rather than the blind carbon copy “BCC” field — is among the most common yet consequential mistakes made in institutional communications. When it involves individuals engaged in sensitive legal or investigative processes, such an error can have far-reaching consequences, including the potential to discourage other victims from coming forward out of fear that their identities will not be adequately protected.

The United Kingdom’s data protection framework, overseen by the Information Commissioner’s Office, obliges organisations handling personal data — including law enforcement bodies — to implement appropriate safeguards. Whether a formal investigation into the breach will be launched by the regulator had not been confirmed at the time of reporting, though such incidents are typically subject to review under existing legislation.

Campaigners and legal representatives working with abuse survivors reacted with dismay to the news, underlining that data security must be treated as a fundamental component of any support structure offered to complainants. For many victims of sexual abuse, the decision to engage with authorities is already fraught with difficulty, and any erosion of confidence in the handling of their personal information risks compounding the harm they have already experienced. Police have said they are reviewing their internal procedures to prevent a recurrence of the error.