South Wales Police has been fined £160,000 and heavily criticised after losing three unencrypted DVDs containing the video of an interview with a victim of serious alleged sexual abuse that was to be used as evidence in a court case.
The original interview with the unnamed subject took place in August 2011, after which the DVDs disappeared from a desk during an office move in October of the same year.
The events were so upsetting that the victim, who was clearly recognisable on the videos, was unable to re-record interviews that had originally run to nearly three hours. The Crown Prosecution had to reconstruct admissible evidence using notes taken during the interview and two defendants were subsequently found guilty at trial.
Complicating the ICO’s dim view of events was that the loss was not reported to them until nearly two years later in August 2013. The organisation found that this happened because the investigating officer’s line manager was unaware of the procedure for reporting data breaches, the ICO said.
South Wales Police also did not have a specific policy on the storage of sensitive video interviews, nor the need to encrypt them.
“Without any doubt we would expect a professional police force, in a position of trust, dealing with this type of highly sensitive information from victims and witnesses on a daily basis to have robust procedures to keep track of the personal data in their care,” commented assistant commissioner for Wales, Anne Jones.
“The organisation has failed to take all appropriate measures against the unauthorised processing and accidental loss of personal data. This breach is extremely serious and despite guidance from our office, the Ministry of Justice and Association of Chief Police Officers stating it is essential to have a policy on storing this sort of information they still haven’t fully addressed the issue.
The size of the financial punishment would send a message to organisations to “take responsibility for personal data and the way in which it is stored,” she said.
Recent public sector ICO fines of this size include the £180,000 slapped on the Serious Fraud Office (SFO) for accidentally sending files related to a bribery investigation to a witness who passed them to a newspaper.
Earlier this week, it emerged that South Wales Police officers aren’t the only ones that don’t think of to report breaches to the ICO – barely one percent of citizens would seek the organisation’s help on this and other issues related to data privacy.