A Stormont department has been fined £185,000 after a filing cabinet containing personal information about victims of a terrorist attack was sold at an auction.
It is the third serious data breach involving the Department of Justice in under two years.
The latest incident involved files on the injuries suffered, family details and compensation offered, as well as confidential ministerial advice.
According to the Information Commissioner's Office, the incident occurred when the Compensation Agency Northern Ireland, which falls under the control of the DoJ, moved offices in February 2012.
Staff did not realise the locked cabinet contained sensitive information, and it was earmarked for auction. It was sold, without a key, to a member of the public in May 2012.
When the buyer forced the lock he found papers dating from the 1970s through to 2005.
The buyer contacted the PSNI, which returned the papers.
ICO assistant commissioner for Northern Ireland Ken Macdonald said: "The distress that could have been caused to victims and their families had this fallen into the wrong hands is self-evident."
The £185,000 fine was reduced to £148,000 for early payment.
Justice Minister David Ford said his department took the security of personal data very seriously and the incident "should not have happened".