A police force has been fined £150,000 after an officer accidentally sent an email containing the personal details of eight sex offenders to a member of the public.
The recipient of the message was mistakenly included in what was supposed to be an internal message group at Dyfed Powys Police, and received five emails meant for other people in four days in April 2015.
One message contained a list of eight sex offenders in Powys, including their names, addresses, telephone numbers and email addresses, the Information Commissioner's Office (ICO) said.
ICO Assistant Commissioner (Wales) Anne Jones said: "While at first glance this might seem like simple human error, it was made possible by the poor procedures the force had in place around protecting people's personal data.
"This is a troubling story, and one that will do little to reassure the local community that its police force can be trusted to look after sensitive information."
An officer accidentally sent the sex offender message to a member of a local community scheme after choosing the wrong name in the force's electronic list of contacts.
The address book was only supposed to contain internal email contacts, but had grown to include frequently used email addresses for people outside the force, said the ICO which fined the police force.
The message recipient was at the top of the alphabetical list and wrongly received five emails over four days.
Ms Jones added: "This was an accident waiting to happen. The force failed to take advantage of earlier opportunities to address the problem, and now faces the consequences of getting it wrong."
Dyfed Powys Police said they work hard to make sure data is kept confidential.
Temporary Deputy Chief Constable Liane James said: "We accept that mistakes were made and have acted to make the necessary changes to processes and systems.
"We work hard to ensure the safety of the data available to us and will continue to take the learning from this, now and in the future."