Manchester plods cop £120k fine for USB-stick-inna-wallet data gaffe

The Greater Manchester Police Force have paid a £120,000 fine after losing the details of more than a thousand people under investigation for serious drugs crime.

The personal details were kept on an unencrypted memory stick with no password protection, belonging to an officer with the Serious Crime Division team. Kept in the officer's wallet it went AWOL in July 2011 after the wallet was swiped from his kitchen table when his home was burgled.

It contained the details of 1,075 people who had been investigated by the drugs squad over the past 11 years.

The weight of the fine from the Information Commissioners Office reflects endemic data security problems that the ICO found in the Manchester police force: officers regularly used unencrypted USB sticks and there were few checks on what data could be downloaded and taken out of the office.

A similar security breach in September 2010 had prompted no change in culture, the ICO said. In 2010 a businessman found a mislaid Greater Manchester Police branded memory stick that contained sensitive anti-terrorism materials.

And officers were still not sufficiently trained in data security, the ICO found.

A unencrypted stick amnesty by the force's data controller after the breach got back a haul of 1,100 devices.

David Smith, ICO Director of Data Protection, said:

This was truly sensitive personal data, left in the hands of a burglar by poor data security. The consequences of this type of breach really do send a shiver down the spine.

It should have been obvious to the force that the type of information stored on its computers meant proper data security was needed. Instead, it has taken a serious data breach to prompt it into action.

®