Greater Manchester Police hit with second £150k fine after fresh data protection breach

Greater Manchester Police has been hit by the Information Commissioner with its second £150,000 fine in less than five years for breaching data protection laws.

The latest fine came after three DVDs containing footage of interviews with victims of violent or sexual crimes got lost in the post.

The force had sent the unencrypted DVDs to the Serious Crime Analysis Section (SCAS) of the National Crime Agency by recorded delivery but they were never received. The DVDs, which showed named victims talking openly, have never been found, the ICO said.

The role of the SCAS is to identify potential serial killers and serial rapists at an early stage in their offending history. Police forces are required to provide the organisation with cases that are considered suitable for such an assessment.

An ICO investigation found that GMP had failed to keep highly sensitive personal information in its care secure and did not have appropriate measures in place to guard against accidental loss.

The force had been sending unencrypted DVDs by recorded delivery to SCAS since 2009 and only stopped after the security breach in 2015.

The ICO previously fined GMP £150,000 in 2012 after an unencrypted USB stick was stolen.

A copy of the latest monetary penalty notice can be viewed here.

Sally Anne Poole, ICO Enforcement Group Manager, said: “When people talk to the police they have every right to expect that their information is handled with the utmost care and respect.

“Greater Manchester Police did not do this. The information it was responsible for was highly sensitive and the distress that would be caused if it was lost should have been obvious.

“Yet GMP was cavalier in its attitude to this data and it showed scant regard for the consequences that could arise by failing to keep the information secure.”