CPS fined £200,000 for data breach after failing to keep recorded police interviews with victims and witnesses secure

Nearly all of the interviews concerned on-going cases of a violent or sexual nature

CPS fined £200k over theft of laptops

The Information Commissioner’s Office (ICO) fined the CPS £200,000 for failing to keep recorded police interviews with victims and witnesses secure. The fine came after laptops containing videos of police interviews were stolen during a burglary in 2014 from a private film studio in Manchester where they were being edited. According to the ICO, the interviews were with 43 victims and witnesses. They involved 31 investigations, nearly all of which were ongoing and of a violent or sexual nature. Some of the interviews related to historical allegations against a high-profile individual.

The victims and witnesses could be seen talking openly in the videos and referring to the names of the offenders, including the high-profile individual. Fortunately, the names and addresses of the victims and witnesses had already been edited out.

The police recovered the laptops eight days after the burglary and it told the ICO that the data had not been accessed by unauthorised third parties.

The ICO’s decision stated that the CPS, being a data controller, had failed to keep the videos secure and that, "The consequences of failing to keep that data safe should have been obvious to them." The CPS had no guarantee that the DVDs, which were unencrypted, would be stored securely or destroyed by the studio once work was completed and in fact, it had not had a Data Protection Act compliant contract with the studio in relation to the processing of the DVDs.

Head of Enforcement at the ICO, Stephen Eckersley said, "Handling videos of police interviews containing highly sensitive personal data is central to what the CPS does. The CPS was aware of the graphic and distressing nature of the personal data contained in the videos, but was complacent in protecting that information. The consequences of failing to keep that data safe should have been obvious to them."