Feeds

NHS fined £375k after stolen patient data flogged on eBay

Hospital bosses appeal against ICO's stiffest punishment yet

Boost IT visibility and business value

The Information Commissioner is proposing to issue its heaviest ever fine for a breach of UK data protection laws. It proposes fining a health body after patient records were stolen from a hospital and sold on eBay.

Brighton and Sussex University Hospitals NHS Trust told Out-Law.com that hard drives containing patient data had been sold on the auction website by a contractor it employed to destroy them. A spokesperson for the Information Commissioner's Office (ICO) said the watchdog had proposed fining the Trust £375,000 over the incident. The Trust has challenged the suggested penalty. "We were the victims of a crime," Duncan Selbie, chief executive of Brighton and Sussex University Hospitals NHS Trust said in a statement. "We subcontracted the destruction of these hard drives to a registered contractor who subsequently sold them on eBay."

"As soon as we were alerted to this we informed the police and with their help we recovered all the hard drives stolen by this individual," he said. "We are confident that there is a very low risk of any of the data from them having passed into the public domain. We have subsequently received a Notice from the Information Commissioner’s Office proposing a fine of £375,000 which we are, in the circumstances, challenging."

Under the Data Protection Act (DPA) organisations must take "appropriate technical and organisational measures ... against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data". The law requires organisations to be extra protective over sensitive personal data, such as patient medical records. In a statement the ICO said it is "currently making inquiries into a possible breach of the Data Protection Act and is unable to speculate on what action will be taken at this time."

The data was lost from Brighton General Hospital in September 2010, according to a report by the BBC.

Under the DPA the ICO has the power to issue penalties of up to £500,000 for serious data breaches. The ICO can issue notices indicating to organisations responsible for the data what punishment, if any, it considers appropriate for the breach but can decide to alter or withdraw the proposed penalty in a final determination if representations made by those organisations persuade it to do so.

The biggest fine the ICO has ever issued is £130,000. The watchdog fined Powys County Council the money after pages from a child protection report were wrongly included as part of a separate document sent to a member of the public.

The ICO recently published an information rights strategy in which it detailed its intention to give "particular regulatory attention" to health organisations as part of prioritisation of its enforcement action.

Copyright © 2012, OUT-LAW.com

OUT-LAW.COM is part of international law firm Pinsent Masons.

Build a business case: developing custom apps

More from The Register

next story
Just TWO climate committee MPs contradict IPCC: The two with SCIENCE degrees
'Greenhouse effect is real, but as for the rest of it ...'
'Blow it up': Plods pop round for chat with Commonwealth Games tweeter
You'd better not be talking about the council's housing plans
Arrr: Freetard-bothering Digital Economy Act tied up, thrown in the hold
Ministry of Fun confirms: Yes, we're busy doing nothing
Government's 'Google Review' copyright rules become law
Welcome in a New Era ... of copyright litigation
Help yourself to anyone's photos FOR FREE, suggests UK.gov
Copyright law reforms will keep m'learned friends busy
Apple smacked with privacy sueball over Location Services
Class action launched on behalf of 100 million iPhone owners
Adam Afriyie MP: Smart meters are NOT so smart
Mega-costly gas 'n' 'leccy totting-up tech not worth it - Tory MP
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.
Maximize storage efficiency across the enterprise
The HP StoreOnce backup solution offers highly flexible, centrally managed, and highly efficient data protection for any enterprise.