CMS News

The Crown Prosecution Service has been fined £200,000 by the ICO after laptops containing videos of police interviews were stolen from a private film studio.

The interviews were with 43 victims and witnesses. They involved 31 investigations, nearly all of which were ongoing and of a violent or sexual nature.

Some of the interviews related to historical allegations against a high-profile individual.

The videos were being edited by a Manchester-based film company so that they could be used in criminal proceedings.

But an ICO investigation found the videos were not being kept secure.

The film company used a residential flat as a studio. The studio was burgled on 11 September 2014 and two laptops containing the videos were stolen. The laptops, which were left on a desk, were password protected but not encrypted and the studio had no alarm and insufficient security.

The police recovered the laptops eight days later and apprehended the burglar. As far as the Commissioner is aware, the laptops had not been accessed by anyone else.

The ICO ruled that the CPS was negligent when it failed to ensure the videos were kept safe and did not take into account the substantial distress that would be caused if the videos were lost.

Head of Enforcement Stephen Eckersley, said:

“Handling videos of police interviews containing highly sensitive personal data is central to what the CPS does. The CPS was aware of the graphic and distressing nature of the personal data contained in the videos, but was complacent in protecting that information.

“The consequences of failing to keep that data safe should have been obvious to them.”

Many of the victims were vulnerable and had already endured distressing interviews with police. In the videos, they talked openly and referred to the names of the offenders.

Mr Eckersley said:

“If this information had been misused or disclosed to others then the consequences could have resulted in acts of reprisal.”

The CPS reported the incident to the ICO and informed the victims and witnesses involved. The ICO received complaints from three affected people.

As part its investigation, the ICO learned that the CPS had been using the same film company since 2002.

The CPS delivered unencrypted DVDs to the studios using a national courier firm. If the case was urgent, the sole proprietor would collect the unencrypted DVD from the CPS personally and take it to the studio using public transport.

The ICO found that this constituted an ongoing contravention of the Data Protection Act until the CPS took remedial action following the security breach on 11 September 2014.

Notes to Editors

1. The Information Commissioner’s Office upholds information rights in the public interest, promoting openness by public bodies and data privacy for individuals.

2. The ICO has specific responsibilities set out in the Data Protection Act 1998, the Freedom of Information Act 2000, Environmental Information Regulations 2004 and Privacy and Electronic Communications Regulations 2003.

3. The ICO is on Twitter, Facebook and LinkedIn. Read more in the ICO blog and e-newsletter. Our Press Office page provides more information for journalists.

4. Anyone who processes personal information must comply with eight principles of the Data Protection Act, which make sure that personal information is:

• Fairly and lawfully processed
• Processed for limited purposes
• Adequate, relevant and not excessive
• Accurate and up to date
• Not kept for longer than is necessary
• Processed in line with your rights
• Secure
• Not transferred to other countries without adequate protection

5. Civil Monetary Penalties (CMPs) are subject to a right of appeal to the (First-tier Tribunal) General Regulatory Chamber against the imposition of the monetary penalty and/or the amount of the penalty specified in the monetary penalty notice.
6. Any monetary penalty is paid into the Treasury’s Consolidated Fund and is not kept by the Information Commissioner’s Office (ICO).