Copper Stopper has discovered that a recent misconduct report published by South Wales Police contained extensive defective redactions that left sensitive officer information exposed, despite the document appearing to have been properly censored. Further to this, the force ignored all of our communications warning them of the breach.
The initial report concerned the misconduct hearing of PC Dorian Krzemien, a South Wales Police officer who avoided dismissal after a series of incidents that included failing to secure firearms found at an address, and failing to attend a priority-graded incident when instructed. The panel imposed a written warning for 18 months, reducing Krzemien’s culpability on the basis of expert medical evidence. That material was meant to be redacted from the published report, but the redactions were defective, meaning the hidden information could be recovered with basic tools.
With redactions spread across four pages, Copper Stopper unearthed material indicating that Krzemien had submitted expert evidence, prior to the hearing, that he had autism – a condition Assistant Chief Constable Jenny Gilmer said was ‘a contributing factor to his behaviour’. She also remarked that Krzemien’s failure to report the guns he had located had ‘not created a dangerous situation’ on the basis that ‘he simply didn’t have the capability to be able to make that decision’.
Prior to the hearing, Gilmer decided that an anonymity order for privacy was to be made in relation to the confidentiality of medical evidence heard during the course of the proceedings. This order was made in response to an application by counsel for PC Krzemien and was not opposed by the Appropriate Authority. South Wales Police were therefore obligated to redact the published report in line with that order. The final report was compiled and finalised by the legally qualified person at the hearing, Christopher McKay, whose name appears in the document metadata.
Our Notice to South Wales
Copper Stopper did not publish the report at the time, or report on the exposed medical information, until we had first alerted South Wales Police to the breach and given them an opportunity to fix it. Despite contacting them via an official DPO email address on 11th January 2026, our notice was ignored. After several days of inaction by the force, we decided to contact South Wales Police by phone to bring the matter to their attention.
We spoke to a 101 call handler on 13th January and asked for PC Krzemien’s email address so we could notify him. The call handler refused to provide it. We then asked for a data protection department email address. Again, the call handler refused. Even when we asked her to confirm the email address we had sent the notice to, so we could be certain the force had received it, she obstructed the request, refused to confirm it, and terminated the call.
In spite of South Wales Police’s indifference, we chose not to not publish our story on the misconduct report until they had removed the flawed document from public view. We did this so as not to compound their breach.
Failure to respond
As a general rule, when a police force is put on notice of a data protection breach, it is expected to treat it as a matter of urgency. That means acknowledging the notification, assessing what data was exposed and to whom, taking immediate containment steps (such as withdrawing or correcting the publication), creating an internal record of the incident, and then considering whether the breach is reportable to the regulator and whether the affected individual should be notified where there is a risk to their rights and freedoms. In this case, South Wales Police did not act upon our notice for four days and only after we made three separate attempts to bring it to their attention. The report’s upload date is recorded as 2nd January, meaning the defective publication remained on the force website for almost two weeks before it was finally pulled.
This is very different from how Devon and Cornwall Police responded to a far less serious data breach we reported in December. In that case, the force was required to remove the officer’s name entirely from the final report. Unfortunately, the officer’s name was published in the PDF metadata, meaning it could be viewed in the browser tab heading. When we reported the breach, the force acted swiftly and diligently. The report was removed and properly redacted within 24 hours. Devon and Cornwall Police also replied to our notice, assuring us that they would record the breach internally, notify the officer concerned, and take steps to ensure it would not be repeated. This is how a conscientious police force should respond. South Wales Police, by contrast, appear to apply a much lower standard when it comes to data protection breaches.
Our official complaint
With no other avenue available to us, we made an official complaint to South Wales Police via the publicly available Professional Standards Department email address. The force refused to accept it, and redirected us to an online portal which would only accept the complaint upon provision of a home address. A complainant is not obliged to provide a home address as a condition of making a complaint, particularly where email is offered and used as a correspondence address.
Around 15th January, after repeated attempts to contact them, South Wales Police finally removed the erroneous document and replaced it with a correctly redacted version. They did not respond to our notice or to our suggestion that it review previously published misconduct reports, which we believe may contain similar redaction failures spanning a number of years.
We have now published our news story on the misconduct report. However, we have not disclosed any additional medical material that was exposed by the defective redactions. We referred only to the fact that PC Krzemien’s autism was relied upon as mitigation, because it was pivotal to understanding the panel’s reasoning and was therefore plainly in the public interest.
Orders not to publish
The panel issued an order that medical evidence should be treated as confidential and redacted from any published determination. Those directions bind South Wales Police and those that are a party to the misconduct hearing. They do not, of themselves, amount to a court-made reporting restriction on third parties. We are not aware of any court order or statutory reporting restrictions in this case that would prohibit publication by the press, as Copper Stopper was not a party to the misconduct proceedings. While misconduct chairs can impose conditions on attendance, including conditions that affect what attendees may report, that is a separate issue from an enforceable nationwide reporting restriction made by a court.
The incident raises wider concerns about the approach used to redact and publish police misconduct documents. If the same method has been applied to multiple reports over time, the accumulated exposure of personal data may be severe.
We await a response from South Wales Police to confirm whether any review has been conducted to identify similar failures, and to disclose how many reports may have been affected.
