Maze Prison files sold at public auction
The Northern Ireland Prison Service has been warned by the data protection regulator after a filing cabinet containing Maze Prison records was sold at auction.
The incident occurred in 2004 when a cabinet that officials thought was empty was sold at a public auction.
However, it actually contained files about the closure of the prison, including the details of staff and a "high-profile" prisoner.
A similar incident occurred in 2012.
When this happened the Information Commissioner's Office (ICO) became aware of the 2004 incident.
By 2012 the Department of Justice Northern Ireland had taken responsibility for prisons across Northern Ireland.
The second incident - which also involved the loss of sensitive information left in an old cabinet sold at auction - resulted in the Department of Justice receiving a penalty of £185,000.
The ICO was unable to issue a penalty for the 2004 breach as the incident occurred before it had the power to issue monetary penalties.
The Northern Ireland Office, which was responsible for prisons at that time, retrieved the information but failed to report the matter to the ICO.
The Maze, on the outskirts of Lisburn, County Antrim, housed paramilitary prisoners during the Troubles, including some of Northern Ireland's most notorious killers. It was closed in 2000.
ICO assistant commissioner for Northern Ireland, Ken Macdonald, said: "This is a story of basic errors and poor procedures, which if the incident happened today would see us issuing a substantial fine.
"The loss of this information represents not only an embarrassing episode for the prison service in Northern Ireland, but a serious breach of the Data Protection Act that could have had damaging repercussions for the individuals affected.
"The incident went unreported for eight years and the same mistakes were allowed to occur. It is only now that we have seen a commitment from the Department of Justice Northern Ireland to tackle these problems and keep people's information secure."
Under an agreement with the ICO, the Northern Ireland Department of Justice must keep a record to ensure condemned equipment containing personal data has been emptied or erased before removal.
They will also introduce annual refresher and induction training for all staff whose role involves the routine processing of personal data by September 2014.