Greater Manchester Police has been fined £150,000 after three unencrypted DVDs containing footage of interviews with victims of violent or sexual crimes were lost in the post.
The Information Commissioner’s Office said today that the force sent the DVDs in 2015 to the National Crime Agency’s Serious Crime Analysis Section (SCAS) by recorded delivery but they were never received.
The section identifies potential serial killers and serial rapists at an early stage in their offending history. Police forces are required to provide SCAS with cases that are considered suitable for such an assessment.
The ICO’s monetary penalty notice states that the DVDs contained a video of a police interview with victims in ongoing cases. The DVDs have not been recovered.
The commissioner's investigation found that GMP had been sending unencrypted DVDs by recorded delivery to SCAS since 2009 and stopped after the security breach in 2015.
In a statement posted on the ICO's website, enforcement group manager Sally Anne Poole said: 'When people talk to the police they have every right to expect that their information is handled with the utmost care and respect.'
'Greater Manchester Police did not do this. The information it was responsible for was highly sensitive and the distress that would be caused if it was lost should have been obvious. Yet GMP was cavalier in its attitude to this data.'
The commissioner found that GMP 'did not have in place appropriate organisational measures for ensuring so far as possible that such an incident would not occur ie for ensuring that the DVDs would not be accidentally lost. In particular, the unencrypted DVDs were sent to SCAS by recorded delivery'.
The contravention was 'serious' because the DVDs contained highly sensitive personal data. The cases were ongoing and of a violent or sexual nature. The named victims could be seen talking openly in the videos.
The commissioner did not think GMP deliberately contravened the Data Protection Act. However, she was satisfied that GMP knew or ought reasonably to have known there was a contravention risk.
The notice states that GMP was aware SCAS required confidential material to be sent special delivery. 'Special delivery is more secure than recorded delivery because an item is signed for every time it changes hands, and not just by the recipient. Royal Mail also treats an item as lost after five days instead of ten, and GMP could have liaised with its security team much sooner,' the commissioner said.
Highlighting mitigating features, the commissioner said GMP referred the incident to the commissioner and SCAS. The information on the DVDs have not been further disseminated, as far as the commissioner is aware. GMP notified the affected individuals and provided support. GMP has taken remedial action until a technical solution is found.
The commissioner took into account the 'aggravating' feature that the DVDs were not password protected.
In a statement, assistant chief constable Rob Potts of Greater Manchester Police said: 'The discs were sent in accordance with national guidance for sending sensitive information. However, when it became apparent that the discs may have been lost we immediately reviewed our own procedures and as a result postal delivery is no longer used by GMP for sensitive information.'
'I think it is important to stress that when the potential loss did become apparent, we worked closely alongside Royal Mail to do everything possible to try to find the discs and immediately informed all those concerned with the video interviews.
'They have been kept updated of this ongoing investigation and contacted this week to inform them of the ICO's decision. We understand that seeing the news of this sanction reaching the public eye may bring back vivid memories of what happened to them and so we are providing them with support from specially trained officers.'
Potts added that national guidance on sending sensitive information has been amended to prevent similar occurrences happening again.
3 Readers' comments