CPS fined £200,000 after laptops containing sexual and violence victim interviews stolen

The Crown Prosecution Service has been fined £200,000 by the Information Commissioner’s Office (ICO) after laptops containing videos of sensitive police interviews were stolen from a private film studio.

The interviews were with 43 victims and witnesses, involved in 31 investigations, nearly all of which were ongoing and of a violent or sexual nature. Some related to historical allegations against a high-profile individual.

The videos were being edited by a Manchester-based film company so that they could be used in criminal proceedings but an ICO investigation found the videos were not being kept secure.

Two laptops were stolen when a residential flat being used by the film company was burgled on September 11, 2014. The laptops were left on a desk in the studio that had no alarm and insufficient security, the ICO said. They were password protected but not encrypted.

The police recovered the laptops eight days later and apprehended the burglar. As far as the Commissioner is aware, the laptops had not been accessed by anyone else.

The CPS had been using the same film company since 2002.

The CPS delivered unencrypted DVDs to the studios using a national courier firm. If the case was urgent, the studio owner would collect the unencrypted DVD from the CPS personally and take it to the studio using public transport.

The ICO found that this constituted an ongoing contravention of the Data Protection Act until the CPS took remedial action following the burglary.

The ICO ruled that the CPS was negligent when it failed to ensure the videos were kept safe and did not take into account the substantial distress that would be caused if the videos were lost.

Head of Enforcement Stephen Eckersley, said: “Handling videos of police interviews containing highly sensitive personal data is central to what the CPS does. The CPS was aware of the graphic and distressing nature of the personal data contained in the videos, but was complacent in protecting that information.

“The consequences of failing to keep that data safe should have been obvious to them.”

The videos showed vulnerable victims talking openly and referred to the names of the offenders.

Mr Eckersley said: “If this information had been misused or disclosed to others then the consequences could have resulted in acts of reprisal.”

The CPS reported the incident to the ICO and informed the victims and witnesses involved. The ICO received complaints from three affected people.

A CPS spokesperson said: “It is a matter of real regret that sensitive information was not held more securely by our external contractor, and that we, as an organisation, failed to ensure that it was.

“We are grateful that the material was recovered without being accessed by those who stole the computer equipment but accept that this was fortuitous.

“It is vital that victims of crime feel confident that breaches like this will not happen and, following a full review after this incident, we have strengthened the arrangements for the safe and secure handling of sensitive material.”

The CPS said its contract with Swan Films was immediately terminated following the incident and it has reassessed security arrangements across the whole of the CPS.