The UK data privacy watchdog fined the Serious Fraud Office £180,000 ($266,000) Monday for mistakenly disclosing evidence in the BAE investigation about 64 confidential witnesses in the case.
The evidence was generated during the SFO’s six-year investigation of military contractor BAE. The probe focused on allegations of a $2 billion payment to a Saudi Arabia official for help selling Typhoon jet fighters to the Saudi government.
The SFO closed the case in February 2010. It began returning the evidence to witnesses who provided it. But between November 2011 and February 2013, one witness was sent over 2,000 evidence bags. The Information Commissioner’s Office said Monday that 407 of the bags contained information about other witnesses.
The information disclosed names and personal data, including bank statements, hospital invoices, and passport details.
The Information Commissioner’s Office, or ICO, enforces the UK Data Protection Act 1998, the Freedom of Information Act 2000, Environmental Information Regulations 2004, and Privacy and Electronic Communications Regulations 2003.
The ICO said a temporary SFO worker who had “minimal training and no direct supervision” prepared the evidence packets that were sent to the witness.
The witness who mistakenly received the evidence disclosed it to The Sunday Times.
ICO deputy commissioner David Smith said Monday:
Anyone who provides information to a criminal investigation does not take this decision lightly and often does so at considerable risk to themselves. . . . Given how high-profile this case was, and how sensitive the evidence being returned to witnesses potentially was, it is astounding that the SFO got this wrong.
The Serious Fraud Office said it has recovered 98 percent of the documents that shouldn’t have been disclosed.
In the United States, BAE paid a criminal fine of $400 million in 2010 after pleading guilty to one charge of conspiring to make false statements to the U.S. government in connection with export licenses and its compliance with the FCPA.
In a deal with the Serious Fraud Office at the same time, BAE paid a penalty of £30 million ($44 million) for failing to keep accounting records of payments to a marketing adviser in Tanzania.
Richard L. Cassin is the publisher and editor of the FCPA Blog. He can be contacted here.