Health trust fined over data breach
Monday 06 August 2012
A health body has been handed a six-figure penalty after publishing sensitive personal details of more than 1,000 NHS staff on the internet.
Employees with the Torbay Care Trust (TCT) in Devon found details of their sexual orientation and religious beliefs were published online, alongside their name, date of birth, pay scale and National Insurance number. It did not contain any patient or clinical data, the trust said.
TCT was handed a £175,000 penalty today, following the investigation by the Information Commissioner's Office (ICO), which described the data breach as "serious" and "extremely troubling".
The ICO said the trust published the information in a spreadsheet on its website in April 2011, and only spotted the mistake when it was reported by a member of the public 19 weeks later.
It was estimated that the spreadsheet was viewed 300 times during that period, although investigators were unable to identify all of those who accessed the information.
The ICO's investigation found that the trust had no guidance for staff on what information should not be published online and had inadequate checks in place to identify potential problems.
Stephen Eckersley, ICO head of enforcement, said: "The fact that this breach was caused by Torbay Care Trust publishing sensitive information about their staff is extremely troubling and was entirely avoidable.
"Not only were they giving sensitive information out about their employees but they were also leaving them exposed to the threat of identity fraud.
"While organisations can publish equality and diversity information about staff in an aggregated form, there is no justification for unnecessarily releasing their personal information. We are pleased that the trust is now taking action to keep its employees' details secure."
In its report, the ICO adds: "The contravention (of security) is serious because (the trust's data protection policies) did not ensure a level of security appropriate to the harm that might result from such unauthorised processing.
"If the data has in fact been accessed by untrustworthy third parties then it is likely that the contravention would cause further distress and also substantial damage to the data subjects such as exposing them to identity fraud and possible financial loss."
The ICO said it had not received any complaints from NHS employees, adding that it was not aware of any previous data breaches at the trust, which has now introduced a new web management policy to make sure personal data is not mistakenly published on the internet.
Apologising to staff, TCT chief executive Anthony Farnsworth said: "This was an organisational issue, in which the absence of sufficient checks within our processes made an error possible, and we have treated this with the utmost seriousness.
"We have since implemented far more robust procedures for managing staff information to make this more secure, and to remove the risk of any such incidents occurring in the future.
"We are of course disappointed that the Information Commissioner has found it necessary to impose a fine for this incident, but we accept the findings. Provision was made to potentially pay such a fine, so there is no affect on budgets for staff, or health and social care services.
"I would like to apologise, again, to these individuals for any concern that has been caused."
Civil liberties campaigners have condemned the body's decision to hold employees' personal information.
Nick Pickles, director of Big Brother Watch, said: "The best way to protect people's privacy is for only absolutely necessary information to be held. Why was a single record of people's salary, sexual orientation and religious views ever created?
"While fining the organisation does send a message to senior management, it is clear that some frontline staff are not taking these issues seriously and far more needs to be done to hold to account those responsible for errors and improve standards to stop small errors having a significant impact on patient privacy."
- 1 Frank Lampard's face drops when Holly Willoughby introduces him as a 'Man City legend'
- 2 Sofyen Belamouadden murder: The inside story of a crime that horrified Britain
- 3 Company breaks open Apple Watch to discover what it says is 'planned obsolescence'
- 4 The Visit: Trailer for M Night Shyamalan's latest horror film is terrifying
- 5 9/11: Iranian General accuses US of organising September 11 terror attacks
General Election 2015: Tories sack candidate who said she would never support 'the Jew' Ed Miliband
9/11: Iranian General accuses US of organising September 11 terror attacks
General Election 2015: Stephen Hawking says he will vote Labour
Manny Pacquiao begs Indonesia president to spare life of drug smuggler Mary Jane Veloso about to be executed
Yazidi sex slaves undergoing surgery to 'restore virginity' after being raped by Isis militants
General Election 2015: Chuka Umunna on the benefits of immigration, humility – and his leader Ed Miliband
The sickening truth about food banks that the Tories don't want you to know
Aaron and Melissa Klein: Oregon anti-gay bakers ordered to pay $135,000 after refusing to make cake for same-sex wedding
Andrew Lloyd Webber: Phantom of the Opera writer mocked after issuing a warning about Ed Miliband and Nicola Sturgeon
General election 2015: Labour will toughen hate crimes legislation surrounding Islamophobia
HSBC review into moving headquarters from UK 'underway'
£16000 - £25000 per annum: Recruitment Genius: A Photographer/ Floor planner /...
£30000 - £40000 per annum: Ashdown Group: Front-End Developer - Guildford/Craw...
£13500 - £15000 per annum: Recruitment Genius: A Customer Service Assistant is...
£16000 - £35000 per annum: Recruitment Genius: An ambitious and motivated Sale...