The Crown Prosecution Service has been fined £325,000 for losing recordings of police interviews with sexual abuse victims.
A watchdog issued the penalty after a package containing 15 unencrypted DVDs due to be used at a trial disappeared.
It is the second time the Information Commissioner’s Office (ICO) has handed the service a six-figure fine for the loss of sensitive video recordings.
In the latest episode, DVDs containing intimate and sensitive details of victims of child sexual abuse, as well as personal data of the accused, were transferred between two CPS offices.
They were sent by tracked delivery from Guildford to Brighton in November 2016.
The delivery was made outside of office hours and the DVDs – which were not in tamper-proof packaging – were left in a reception area.
Although the building’s entry doors were locked, anyone with access to the building could access the reception area, the ICO said.
It was more than a week before the loss was discovered.
The CPS failed to take basic steps to protect the data of victims of serious sexual offencesSteve Eckersley, ICO head of enforcement
The CPS notified the abuse victims in March last year, and reported the loss to the ICO the following month.
The DVDs and personal data have not been recovered.
“So far as the commissioner is aware, it is unknown what has happened to them and whether there has been unauthorised access of that personal data,” the penalty notice said.
It concluded that the CPS was negligent when it failed to ensure the videos were kept safe.
The watchdog also noted that the service was fined £200,000 in 2015 following a previous breach relating to victim and witness interviews.
Steve Eckersley, head of enforcement at the ICO, said: “The victims of serious crimes entrusted the CPS to look after their highly sensitive personal data – a loss in trust could influence victims’ willingness to report serious crimes.
“The CPS failed to take basic steps to protect the data of victims of serious sexual offences.
“Given the nature of the personal data, it should have been obvious that this information must be properly safeguarded, as its loss could cause substantial distress.
“The CPS must take urgent action to demonstrate that it can be trusted with the most sensitive information.”
A CPS spokeswoman said: “We accept the ICO’s decision that we breached the Data Protection Act and last year contacted victims’ families to explain what had happened and apologise. We also offered to meet families face-to-face.
“There is no indication the material was viewed by any unauthorised person.
“The original version of the data was retained by the police and the defendant pleaded guilty in court.”
She said CPS South East has “completely reviewed” its systems and processes “to ensure that this situation cannot arise again”, while a new digital system is being rolled out to allow the secure online transfer of material between the CPS and police.
The CPS will pay the fine before June 13, meaning it will be set at a reduced amount of £260,000.