Hasaan Arshad, 25, was in "flagrant breach" of security rules when he took secret data home.