The fine was levied against the BPAS for failing to secure the data properly.

The incident drew the attention of the Information Commissioner's Office who found BPAS's security didn't meet the legal requirements.