The action was prompted by the theft of a memory stick containing sensitive personal data from a police officer’s home. The device, which had no password protection, contained details of more than 1000 people with links to serious crime investigations.
The ICO found that a number of officers across the force regularly used unencrypted memory sticks, which may also have been used to copy data from police computers to access away from the office. Despite a similar security breach in September 2010, the force had not put restrictions on downloading information, and staff were not sufficiently trained in data protection.
The findings prompted the Information Commissioner to use his powers under the Data Protection Act to impose a civil monetary penalty of GB pound 150,000, reduced to GB pound 120,000 for an early payment discount.
“This was truly sensitive personal data, left in the hands of a burglar by poor data security,” said David Smith, ICO director of data protection. “The consequences of this type of breach really do send a shiver down the spine.
“It should have been obvious to the force that the type of information stored on its computers meant proper data security was needed. Instead, it has taken a serious data breach to prompt it into action.
“This is a substantial monetary penalty, reflecting the significant failings the force demonstrated. We hope it will discourage others from making the same data protection mistakes.”
Responding to the findings, assistant chief officer Lynne Potts of Greater Manchester Police said: “The force is aware of the decision of the ICO to impose a monetary penalty for the data loss following a burglary at the home of a serving officer last year.
“This was very much an isolated incident. We take all matters relating to the storage of data extremely seriously and have stringent measures in place to ensure the safe storage of data.”
