Welsh police force fined £160,000 after losing sensitive video interview

South Wales Police has been hit with a £160,000 fine for losing a video recording which formed part of the evidence in a sex abuse case.

The lost DVDs contained film of an interview with a victim, who had been sexually abused as a child. Despite the DVDs containing a graphic and disturbing account of events, the discs were unencrypted and left in a desk drawer.

The loss was discovered after an office move in October 2011, two months after the interview took place, but the security breach went unreported for nearly two years.

Data privacy watchdogs at the ICO (Information Commissioner's Office) put the tardy reporting down to a lack of staff training, rather than any attempt to hush up the incident.

Although the DVDs were stored in a secure part of the police station, South Wales Police had no specific force-wide policy in place to deal with the safe storage of victim and witness interviews in its facilities.

A second interview had to be abandoned due to the victim’s distress and the DVDs have still not been recovered. The defendants in the case were eventually convicted in court.

“Without any doubt we would expect a professional police force, in a position of trust, dealing with this type of highly sensitive information from victims and witnesses on a daily basis, to have robust procedures to keep track of the personal data in their care," said Anne Jones, ICO Assistant Commissioner for Wales.

“The organisation has failed to take all appropriate measures against the unauthorised processing and accidental loss of personal data. This breach is extremely serious and despite guidance from our office, the Ministry of Justice and Association of Chief Police Officers stating it is essential to have a policy on storing this sort of information, they still haven’t fully addressed the issue," she added in a statement on the settlement.

In addition to the monetary penalty, the Information Commissioner has asked the police force to sign an undertaking promising to revamp its data protection procedures, so as to safeguard against any repeat of the breach. ®