Force fined for losing victim DVDs
A police force has been hit by a record £160,000 fine for losing footage of an interview with a sex abuse victim.
South Wales Police was hit with the penalty after DVDs containing video of the woman's "graphic and disturbing" account went missing after they were left unencrypted in a desk drawer.
It is the third time the Information Commissioner's Office (ICO) has taken such action against a police force and the largest fine so far.
The force apologised to the victim but said it was considering appealing against the "very significant" penalty.
The recorded interview took place in August 2011 and the loss was discovered by staff after an office move in October that year. However, the security breach was not reported for nearly two years.
The DVDs, which show the woman's face clearly throughout, have still not been recovered. Victims of sexual abuse are automatically entitled to anonymity for life.
After being informed of the breach, the victim made a formal complaint that it could have affected the outcome of the case. The defendants in the case were ultimately convicted and sentenced.
Although the DVDs in this case were stored in a secure area of a police station, the ICO said that South Wales Police had no specific force-wide policy to deal with the safe storage of victim and witness interviews in its police stations
Anne Jones, assistant commissioner for Wales, said South Wales Police had " failed to take all appropriate measures against the unauthorised processing and accidental loss of personal data".
She added: "This breach is extremely serious and despite guidance from our office, the Ministry of Justice and Association of Chief Police Officers stating it is essential to have a policy on storing this sort of information they still haven't fully addressed the issue.
"The monetary penalty given to South Wales Police should send a clear message that organisations have to take responsibility for personal data and the way in which it is stored."
The ICO's penalty notice said the DVDs were being stored in an investigating officer's desk in an area of a police station where access was restricted by a digital electronic keypad.
In October 2011, the officer became aware that they had been lost following an internal office move. The ICO said the investigating officer's line manager was not aware of the procedure for reporting security breaches so the data controller was unaware of the loss until August 2013.
The CPS was in the process of prosecuting the matter at the time the discs were lost. There were written notes to back up the DVD but prosecutors asked police to carry out a second interview to clarify some issues.
However, the recollection of the sexual abuse was so distressing that the interview had to be abandoned. The CPS relied on a statement from the victim clarifying her evidence.
South Wales Police Assistant Chief Constable Richard Lewis said : "This is the first incident of a serious nature regarding loss of sensitive data for South Wales Police and unlike similar incidents which have occurred nationally, where materials have been lost in a public place, the DVDs were stored in a secure area of a police station to which access is restricted.
"It is worth stressing that while South Wales Police accept the ICO decision this is a very significant financial penalty particularly at a time of such financial austerity.
"It is money which does not go to the victim but passes back to the Government and are funds that could have been used locally by the force to help enhance policing and provide vital services to our communities.
"South Wales Police is currently considering whether to now appeal against this penalty."
After an investigation, two officers were given "management advice and training", while the force introduced new measures including moving information of this nature to a central storage facility and mandatory training packages for all staff handling personal data.
Mr Lewis said: "South Wales Police takes its responsibilities for the management and security of information extremely seriously and has apologised to the victim in this case.
"Fortunately in this case the loss of the DVDs in question did not interfere with the criminal justice process and a successful prosecution was still achieved in the courts."
In 2012, Greater Manchester Police was fined £120,000 following the theft of a memory stick containing names of members of the public who gave statements in drug probes.
Last year Kent Police was given a £100,000 penalty after confidential information, including copies of police interview tapes, were abandoned at a former police station.
The ICO can issue fines of up to £500,000 for serious breaches of the Data Protection Act.