Image source, PA MediaLate Harrods owner Mohamed Al Fayed is at the centre of a police investigation
ByMatthew HillSouth West correspondent
The Metropolitan Police has apologised after it inadvertently disclosed email addresses of around 140 women who say they were sexually abused by the late Harrods owner Mohamed Al Fayed.
Scotland Yard confirmed to the BBC it copied in all those who had signed up to receive a monthly email update for victims instead of blind copying them.
The update revealed a further three suspects in their 70s and 80s had been interviewed under caution, bringing the total number interviewed to seven.
The force said it had referred itself to the Information Commissioner’s Office (ICO). It is considering providing further support to the victims along with additional safeguards.
A Met Police spokesperson told the BBC a monthly update sent to victims on 11 August regarding Operation Cornpoppy had contained details of progress in the investigation.
Operation Cornpoppy is the Metropolitan Police investigation into people who may have facilitated or enabled sexual offending by Al Fayed.
The spokesperson said: “Due to human error, recipients’ email addresses were visible to others on the distribution list. The issue was identified quickly and immediate action was taken.
“We understand the impact this may have on victims and sincerely apologise. Everyone affected was contacted directly on the day of the incident.
“The incident is being investigated as a matter of priority, and we are reviewing our processes to help prevent a similar breach from happening again.”
The force said the breach affected victims who had opted in to receive updates from the investigation team, but recipients had been split into smaller groups, meaning email addresses were only visible within those groups rather than across the entire cohort.
The BBC understands around 140 women have signed up to the updates.
The force has previously said 154 victims have reported allegations connected to Al Fayed and that supporting survivors remains at the heart of the investigation.
It said the incident had been formally recorded within the investigation records and they would continue to monitor the circumstances and impact of the breach, including reviewing alternative methods of updating victims that would reduce the risk of human error.
The force added that victim-survivors remained its priority and said it was committed to providing updates to those involved in the investigation.
The latest disclosure is likely to raise fresh questions about the Metropolitan Police’s handling of sensitive survivor information.
Campaigners have repeatedly stressed the importance of protecting the identities of people involved in investigations into sexual abuse and trafficking because of the potential impact on victims’ wellbeing and privacy.
Joanna Brittan, from Devon, who spoke to the BBC after waiving her automatic lifelong right to anonymity, discovered her email address had been disclosed to dozens of other survivors after an update about Operation Cornpoppy was sent to multiple recipients with their email addresses visible.
In an email seen by the BBC, Brittan wrote to senior officers saying her email address had “been disclosed to 42 other survivors, and I have likewise been given access to their email addresses”.
She described the incident as particularly serious because recipients were identifiable as people connected to a highly sensitive criminal investigation.
“I consider this to be a further personal data breach by the Metropolitan Police Service,” she wrote.
Joanna Brittan, who has waived her anonymity, was one of the women in the breach
Brittan said she had previously been offered compensation for another data breach by the Met, after they disclosed sensitive information about her first police interview by mistake to two people in Australia.
Speaking about the latest breach, the 61-year-old told the BBC: “It’s very shocking because they were meant to have learned all lessons and it would never happen again.
“And although the first one was far more egregious because it was very sensitive data that was sent to Australia, I was promised that they had learned and the same thing couldn’t happen again.
She added that many of Al Fayed’s alleged victims would be distressed by the breach, saying: “For me, it’s more of the same, really, and deeply re abusive, to be honest. It’s unbelievable.”
Dame Jasvinder Sanghera, the advocate for survivors of alleged abuse by Al Fayed, told the BBC: “I have had so many contacts today from survivors who have told me that they feel violated by the police in a space where there is already a lack of confidence in the police investigation.
“They said they received an insipid apology five hours later and, I am sorry, it is just not good enough.”
Brittan first reported allegations to police in 2017.
According to correspondence previously supplied to the BBC, she alleged she was sexually abused by Ahmed Obaidly, a former United Arab Emirates diplomat and associate of Al Fayed, after working for a company linked to the UAE royal family in the early 1990s.
The Met has said the original report, made to Devon and Cornwall Police in 2017, was transferred to London because the alleged offending took place within its jurisdiction. It said the case was initially investigated as a rape allegation against Obaidly, who died in 2015.
The force has also said criminal allegations concerning Mohamed Al Fayed were made in 2024 and now form part of Operation Cornpoppy, which remains ongoing.
In correspondence previously provided to the BBC, the Met said: “The live investigation into those who could have facilitated or enabled Mohamed Al Fayed’s offending continues.”
The force added that victim-survivors remained its priority and said it was committed to providing updates to those involved in the investigation.
The latest incident comes shortly after the ICO took enforcement action against the Metropolitan Police over two unrelated data breaches.
In a decision published on 5 August, the watchdog issued the force with a reprimand and enforcement notice after concluding it had failed to put in place appropriate technical and organisational measures to protect personal information.
The ICO said its investigation had uncovered “serious and ongoing shortcomings” in data protection training.
It also found wider weaknesses in policies, procedures and assurance arrangements for handling sensitive personal data.
One breach involved an officer disclosing a stalking victim’s new address and telephone number to her alleged stalker.
As part of its enforcement notice, the ICO ordered the Metropolitan Police to improve its data protection training compliance, monitoring and governance arrangements.
