Feeds

Nursing watchdog fined £150k for confidential unencrypted DVD loss

'Highly sensitive' discs for 'fitness to practise' hearing vanish

Next gen security for virtualised datacentres

The UK's data protection watchdog has fined the Nursing and Midwifery Council (NMC) £150,000 after it deemed its failure to encrypt sensitive personal data stored on DVDs that were lost to be a serious breach of the Data Protection Act.

The nursing and midwifery regulator had arranged for the DVDs, which contained confidential and "highly sensitive" video files relating to alleged offences by a nurse as well information about two vulnerable children, to be couriered from its offices to a 'fitness to practise' hearing in October 2011.

However, upon arrival at the hearing it was discovered that the couriered package did not contain the DVDs and which have to-date still to be recovered.

The Information Commissioner's Office (ICO) imposed a civil monetary penalty on NMC after discovering that the body had no policy in place to ensure such information was encrypted when either stored at its offices or whilst in transit.

"The Commissioner published guidance on his website in November 2007 about the risks associated with the use of unencrypted portable devices and removable media used to store or process personal data, the loss of which would be likely to cause distress to individuals," The civil monetary penalty notice served to NMC by the ICO said.

"This guidance states the Commissioner's view that such devices or media should be encrypted to protect the data, and that failure to do so may lead to enforcement action where these equipment and data are subsequently lost or misused."

"Further, it should have been obvious to [NMC] whose employees were used to handling sensitive personal data that such a contravention would be of a kind likely to cause substantial distress to the data subjects due to the nature of the data involved," it said.

Under the Data Protection Act data controllers are required to take "appropriate technical and organisational measures" to ensure against the "unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data". Deputy Information Commissioner David Smith said data encryption failings were not confined to NMC.

"It would be nice to think that data breaches of this type are rare, but we’re seeing incidents of personal data being mishandled again and again," Smith said in a statement. "While many organisations are aware of the need to keep sensitive paper records secure, they forget that personal data comes in many forms, including audio and video images, all of which must be adequately protected."

"I would urge organisations to take the time today to check their policy on how personal information is handled. Is the policy robust? Does it cover audio and video files containing personal information? And is it being followed in every case? If the answer to any of those questions is no, then the organisation risks a data breach that damages public trust and a possible weighty monetary penalty," he said.

"The Nursing and Midwifery Council’s underlying failure to ensure these discs were encrypted placed sensitive personal information at unnecessary risk," Smith added. "No policy appeared to exist on how the discs should be handled, and so no thought was given as to whether they should be encrypted before being couriered. Had that simple step been taken, the information would have remained secure and we would not have had to issue this penalty."

Copyright © 2013, Out-Law.com

Out-Law.com is part of international law firm Pinsent Masons.

The essential guide to IT transformation

More from The Register

next story
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
e-Borders fiasco: Brits stung for £224m after US IT giant sues UK govt
Defeat to Raytheon branded 'catastrophic result'
Chinese hackers spied on investigators of Flight MH370 - report
Classified data on flight's disappearance pinched
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
Think crypto hides you from spooks on Facebook? THINK AGAIN
Traffic fingerprints reveal all, say boffins
prev story

Whitepapers

A new approach to endpoint data protection
What is the best way to ensure comprehensive visibility, management, and control of information on both company-owned and employee-owned devices?
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Maximize storage efficiency across the enterprise
The HP StoreOnce backup solution offers highly flexible, centrally managed, and highly efficient data protection for any enterprise.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.