Police force fined £160k after losing DVDs of interview with abuse victim
The Information Commissioner’s Office has imposed a £160,000 monetary penalty on a police force after it lost DVDs of an interview which formed part of the evidence in a sexual abuse case.
An investigating officer at South Wales Police had possession of three unencrypted DVDs (one master copy and two working copies).
These all contained the same video recording of an interview with a victim who had been sexually abused when a child. The DVDs were the only digital records of the interview, which took place on 25 August 2011.
The contents of the video were said to be “graphic and distressing”. The victim’s face could also be seen clearly throughout the recording, while both perpetrators were named.
South Wales Police did not a have a specific policy on how DVDs containing the video recordings of victim and witness interviews should be stored in police stations. Storage practices varied across the force for some time.
The DVDs were left in a desk drawer in a secure part of the police station.
In October 2011 the investigating officer became aware that they had been lost following an internal office move.
Despite extensive searches of the police stations and enquiries being made elsewhere, the DVDs could not be found.
The officer’s line manager meanwhile was unaware of the procedure for reporting security breaches. As a result South Wales Police as the data controller was not aware the DVDs had been lost until 12 August 2013.
The Crown Prosecution Service was in the process of prosecuting the matter at the time the DVDs were lost. There were written notes of the interview to back up the DVD.
The CPS asked the police force to re-interview the victim just to clarify some issues arising out of the written notes.
South Wales Police attempted to carry out a further interview with the victim but the recollection of the abuse was so distressing that it had to be abandoned, the ICO said.
The CPS therefore relied on a statement provided by the victim under s. 9 of the Criminal Justice Act 1967 to clarify her evidence.
The victim was informed of the security breach. She made a formal complaint to South Wales Police that the loss of the DVDs could have affected the outcome of the case. Both defendants were found guilty at the trial.
In the monetary penalty notice (MPN), which can be viewed here, the ICO said South Wales Police had failed to take appropriate organisational measures against the unauthorised processing and accidental loss of personal data.
The watchdog said such measures could have included:
- Centralised storage of the DVDs/log;
- Usage procedures/log;
- Secure storage of master copies; and
- Regular training in relation to reporting procedures following a security breach.
The ICO added that it considered the contravention was very serious “because for some time, there has been an underlying failure by the data controller to put appropriate security measures in place for the unencrypted DVDs that were intended for use in criminal proceedings”.
The MPN also noted that the victim was “justifiably concerned” that the prosecution could have been jeopardised. She had had to endure a second interview and give evidence at the trial, which may have been curtailed if the DVDs had been in existence.
The victim in addition feared that her data might be further disseminated. The DVDs had still not been recovered.
“In this context it is important to bear in mind that the victim is a vulnerable young adult,” the ICO said.
In addition to levying a monetary penalty, the ICO has also required South Wales Police to sign an undertaking to ensure changes are made to implement policies to stop any incidents happening again.
Anne Jones, ICO Assistant Commissioner for Wales said: “Without any doubt we would expect a professional police force, in a position of trust, dealing with this type of highly sensitive information from victims and witnesses on a daily basis to have robust procedures to keep track of the personal data in their care.
“This breach is extremely serious and despite guidance from our office, the Ministry of Justice and Association of Chief Police Officers stating it is essential to have a policy on storing this sort of information they still haven’t fully addressed the issue.”
Jones added: “The monetary penalty given to South Wales Police should send a clear message that organisations have to take responsibility for personal data and the way in which it is stored.”
