UK ICO fines Crown Prosecution Service for stolen interview DVDs

The UK Information Commissioner’s Office has fined Crown Prosecution Service (CPS) £200,000 for failing to maintain the security of recorded police interviews with victims and witnesses. The interviews concerned 31 police investigations, nearly all of which were on-going and of a violent or sexual nature.

CPS couriered unencrypted DVDs containing the videos of the police interviews to a private film company for editing.  The film company used a residential flat as a studio.  The studio was burgled and two laptops containing the videos were stolen.  The laptops, which were left on a desk, were password protected but unencrypted and the studio had no alarm and insufficient security.

The Commissioner considered that CPS failed to take reasonable steps to prevent the breach.  On the facts, the Commissioner concluded that reasonable steps would have included:

  • inspecting the film company’s premises to ensure that they were suitable for the editing of videos containing police interviews;
  • having a guarantee that the unencrypted DVDs would be stored in a lockable cabinet;
  • having a guarantee that any laptops containing the videos were encrypted by the film company; and
  • provision had been made for the return or destruction/erasure of the DVDs/videos at the end of the case.

Link (ICO): Monetary Penalty Notice under the Data Protection Act 1998