Greater Manchester Police has been fined £150,000 after three DVDs containing footage of interviews with victims of violent or sexual crimes were lost in the post.
Cops sent the unencrypted (our emphasis) DVDs to the Serious Crime Analysis Section of the National Crime Agency by recorded delivery but they never arrived. The DVDs, which showed named victims talking openly, have never been found.
An investigation by data privacy watchdogs at the Information Commissioner’s Office (ICO) found that Greater Manchester Police “failed to keep highly sensitive personal information in its care secure and did not have appropriate measures in place to guard against accidental loss”. The force’s routine procedures of sending unencrypted DVDs by recorded delivery constituted a a breach of data protection law.
The ICO investigation found that GMP had been sending unencrypted DVDs by recorded delivery to SCAS since 2009 and only stopped after the security breach (lost DVD incident) in 2015.
Sally Anne Poole, ICO enforcement group manager, said: “When people talk to the police they have every right to expect that their information is handled with the utmost care and respect.
“Greater Manchester Police did not do this. The information it was responsible for was highly sensitive and the distress that would be caused if it was lost should have been obvious,” she added.
The ICO previously fined GMP £150,000 in 2012 after an unencrypted USB stick was stolen. There are precedents for other UK police forces being fined after losing sensitive video interviews.
For example, South Wales Police were fined £163,000 after losing a sensitive video interview back in 2015. ®
Source: SANS ISC SecNewsFeed @ May 4, 2017 at 06:48AM