Can you make a data breach claim against the Crown Prosecution Service?

In May this year, the Information Commissioner's Office (ICO) issued a £325,000 fine following the loss of recorded police interviews by the Crown Prosecution Service (CPS). The DVDs contained interviews with 15 victims of child sex abuse and were to be used at trial.

Shockingly, the recordings were also unencrypted, and the failure to protect such sensitive information has led to concerns that a "loss in trust could influence victims' willingness to report serious crimes".

Such data breaches could also have severe consequences for those affected. So, victims should now be looking to make a data breach claim against the Crown Prosecution Service.

What happened in this case?

In November 2016, the DVDs were sent by tracked delivery from Guildford to Brighton for a trial. But, because the delivery was made outside of office hours, they were left at an office reception in a shared building.

The recordings, which were not sent in tamper-proof packaging, contained highly intimate and sensitive details of the victims, as well as the personal data of the perpetrator, and identified information about other individuals.

It was over a week before the loss was discovered and while the building's entry doors were locked, deliveries that were left there could be accessed by anyone with admission to the building.

The DVDs and the information contained on them have not been found, so it is unclear what has happened to them and whether anyone has watched them.

To make matters worse, this is the second time that the CPS has failed to take necessary steps to protect sensitive data. In 2015, the CPS was fined £200,000 by the ICO after the theft of laptops containing videos of police interviews uncovered serious security failures by the government body.

What was the result of the latest investigation?

In its judgement, the ICO found that the CPS was negligent by failing to ensure that the videos were kept safe. The CPS was also accused of not taking into account the substantial distress that would be caused if the videos were lost.

Astonishingly the investigation also revealed that while encryption software is available to the CPS, it is not routinely used to protect such evidence.

As a result, as well as the £325,000 fine, the ICO ruled that, due to a lack of proper processes across the organisation, staff training within the CPS was needed immediately.

Stephen Eckersley, head of enforcement at the ICO, said:

"The CPS failed to take basic steps to protect the data of victims of serious sexual offences. Given the nature of the personal data, it should have been obvious that this information must be properly safeguarded, as its loss could cause substantial distress.

"The CPS must take urgent action to demonstrate that it can be trusted with the most sensitive information."

What can you do?

While the ICO has the power to impose hefty fines on organisations who fail to meet their data protection obligations, it does not award compensation to victims. But, once an organisation has been found guilty by the ICO - as in this case - you can use that information to support a data protection compensation claim.

The latest breach by the CPS is particularly worrying as many of the victims were already vulnerable and had already endured significant distress during their interviews with the police. As such, the loss of these recordings is likely to cause considerable emotional anguish.

What's more, while the CPS has said that it has now strengthened arrangements to prevent further incidents, its failure to do so following the last data protection breach highlights a shocking disregard for those people it should be protecting. The CPS simply did not make sure that appropriate care was taken to avoid similar breaches re-occurring.

The CPS was aware of the graphic and distressing nature of the personal data contained in the DVDs, but it was complacent in caring for that information and those it is supposed to protect. So it must be held to account.

Victims who had their data accessed were informed about the breach. And, while the CPS has offered to meet victims' families to apologise, this does not cancel the right to proper compensation.

If you are one of those affected and are concerned that your data was treated negligently, contact Hayes Connor Solicitors immediately. We can help you to make a data breach claim against the Crown Prosecution Service and claim the maximum amount of compensation in the minimum amount of time, on a no-win, no-fee basis.

With strict-time limits in place for making most compensation claims, if you want to achieve maximum recompense in the minimum amount of time, it's essential to act now.

IF YOU THINK YOU MAY HAVE A DATA BREACH CLAIM COMPLETE OURCONTACT FORM.