Feeds

Nursing watchdog fined £150k for confidential unencrypted DVD loss

'Highly sensitive' discs for 'fitness to practise' hearing vanish

Secure remote control for conventional and virtual desktops

The UK's data protection watchdog has fined the Nursing and Midwifery Council (NMC) £150,000 after it deemed its failure to encrypt sensitive personal data stored on DVDs that were lost to be a serious breach of the Data Protection Act.

The nursing and midwifery regulator had arranged for the DVDs, which contained confidential and "highly sensitive" video files relating to alleged offences by a nurse as well information about two vulnerable children, to be couriered from its offices to a 'fitness to practise' hearing in October 2011.

However, upon arrival at the hearing it was discovered that the couriered package did not contain the DVDs and which have to-date still to be recovered.

The Information Commissioner's Office (ICO) imposed a civil monetary penalty on NMC after discovering that the body had no policy in place to ensure such information was encrypted when either stored at its offices or whilst in transit.

"The Commissioner published guidance on his website in November 2007 about the risks associated with the use of unencrypted portable devices and removable media used to store or process personal data, the loss of which would be likely to cause distress to individuals," The civil monetary penalty notice served to NMC by the ICO said.

"This guidance states the Commissioner's view that such devices or media should be encrypted to protect the data, and that failure to do so may lead to enforcement action where these equipment and data are subsequently lost or misused."

"Further, it should have been obvious to [NMC] whose employees were used to handling sensitive personal data that such a contravention would be of a kind likely to cause substantial distress to the data subjects due to the nature of the data involved," it said.

Under the Data Protection Act data controllers are required to take "appropriate technical and organisational measures" to ensure against the "unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data". Deputy Information Commissioner David Smith said data encryption failings were not confined to NMC.

"It would be nice to think that data breaches of this type are rare, but we’re seeing incidents of personal data being mishandled again and again," Smith said in a statement. "While many organisations are aware of the need to keep sensitive paper records secure, they forget that personal data comes in many forms, including audio and video images, all of which must be adequately protected."

"I would urge organisations to take the time today to check their policy on how personal information is handled. Is the policy robust? Does it cover audio and video files containing personal information? And is it being followed in every case? If the answer to any of those questions is no, then the organisation risks a data breach that damages public trust and a possible weighty monetary penalty," he said.

"The Nursing and Midwifery Council’s underlying failure to ensure these discs were encrypted placed sensitive personal information at unnecessary risk," Smith added. "No policy appeared to exist on how the discs should be handled, and so no thought was given as to whether they should be encrypted before being couriered. Had that simple step been taken, the information would have remained secure and we would not have had to issue this penalty."

Copyright © 2013, Out-Law.com

Out-Law.com is part of international law firm Pinsent Masons.

New hybrid storage solutions

More from The Register

next story
Google recommends pronounceable passwords
Super Chrome goes into battle with Mr Mxyzptlk
Infosec geniuses hack a Canon PRINTER and install DOOM
Internet of Stuff securo-cockups strike yet again
Snowden, Dotcom, throw bombs into NZ election campaign
Claim of tapped undersea cable refuted by Kiwi PM as Kim claims extradition plot
Reddit wipes clean leaked celeb nudie pics, tells users to zip it
Now we've had all THAT TRAFFIC, we 'deplore' this theft
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
TorrentLocker unpicked: Crypto coding shocker defeats extortionists
Lousy XOR opens door into which victims can shove a foot
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.