The Information Commissioner's Office (ICO) has fined South Wales Police £160,000 after the loss of a DVD containing sensitive video evidence.
The ICO said in a report on the case (PDF) that the DVD contained witness evidence relating to a sexual abuse case, as well as other information and material, and was left unchecked and unprotected and went missing.
The DVD was apparently left in an unlocked drawer. It was taken and stored in August 2011, and discovered to be missing three months later during an office move.
The ICO said that the loss went unreported for two years, and that this was down to a lack of training.
The ICO added that the DVDs were in a "secure part" of the police station, but that South Wales Police had no "specific force-wide policy in place to deal with the safe storage of victim and witness interviews in its police stations".
The ICO said that it expected South Wales Police to have better systems in place to protect victims and witnesses.
"Without any doubt we would expect a professional police force, in a position of trust, dealing with this type of highly sensitive information from victims and witnesses on a daily basis, to have robust procedures to keep track of the personal data in their care," said Anne Jones, ICO assistant commissioner for Wales.
"The organisation has failed to take all appropriate measures against the unauthorised processing and accidental loss of personal data.
"The monetary penalty given to South Wales Police should send a clear message that organisations have to take responsibility for personal data and the way in which it is stored."
This is not the first time that the ICO has criticised the police. Kent Police was fined £100,000 last year for leaving sensitive documents, including tape recordings of suspect and witness interviews, in its old offices after it moved headquarters in 2009.
Jones added that the ICO has given the Ministry of Justice and the Association of Chief Police Officers (ACPO) plenty of advice and guidance in these matters, and has asked the force to commit to positive changes.
"This breach is extremely serious. Despite guidance from our office, the Ministry of Justice and ACPO stating it is essential to have a policy on storing this sort of information, they still haven't fully addressed the issue," she said.
Assistant chief constable Richard Lewis said the force had apologised to victim in this case and has changed its policies as a result.
"South Wales Police has also immediately sought to change its processes and a new policy has been put in place.
However, he said the force was considering appealing the penalty given its size.
"It is worth stressing that while South Wales Police accept the ICO decision this is a very significant financial penalty particularly at a time of such financial austerity," he said.
"It is money which does not go to the victim but passes back to the Government and are funds that could have been used locally by the force to help enhance policing and provide vital services to our communities."
Russian Taiga smartphone promises snoop-proof communications - coming soon to employees of Russian state-owned firms
Eugene Kaspersky's ex outs smartphone that claims to prevent apps from spying on users
Deloitte accused of leaving its internal Active Directory server exposed to the internet with RDP open
Deloitte accused of lax systems administration and security practices over email hack
Lax systems administration practices blamed for exposing millions of sensitive client emails
The new processors support Intel's Optane memory acceleration technology