The Crown Prosecution Service delivered unencrypted DVDs to a film studio for 12 years, it emerged today.
The revelation was made by the Information Commissioner’s Office, which fined the CPS £200,000 for failing to secure recorded police interviews with victims and witnesses.
Publishing news of the fine on its website, the ICO said two laptops containing videos of police interviews with 43 victims and witnesses were stolen from a private film studio last year.
The videos involved 31 investigations, ‘nearly all of which were ongoing and of a violent or sexual nature’, the ICO said.
The Manchester-based film company used a residential flat as a studio, which had no alarm and ‘insufficient’ security.
The studio was burgled on 11 September last year. The laptops, which were left on a desk, were password protected but not encrypted, the ICO said. The police recovered the laptops eight days later.
‘As far as the commissioner is aware, the laptops had not been accessed by anyone else,’ the statement said.
The CPS reported the incident to the ICO and informed the victims and witnesses involved, the statement said. The ICO received complaints from three affected people.
‘As part of its investigation, the ICO learned that the CPS had been using the same film company since 2002,’ the statement said.
‘The CPS delivered unencrypted DVDs to the studios using a national courier firm. If the case was urgent, the sole proprietor would collect the unencrypted DVD from the CPS personally and take it to the studio using public transport.
‘The ICO found that this constituted an ongoing contravention of the Data Protection Act until the CPS took remedial action following the security breach on 11 September 2014.’
The CPS said on its website today that it was a 'matter of real regret' that sensitive information 'was not held more securely by our external contractor, and that we, as an organisation, failed to ensure that it was'.
A spokesperson said: 'We are grateful that the material was recovered without being accessed by those who stole the computer equipment but accept that this was fortuitous.
'It is vital that victims of crime feel confident that breaches like this will not happen and, following a full review after this incident, we have strengthened arrangements for the safe and secure handling of sensitive material.'