Nursing watchdog fined £150k for confidential unencrypted DVD loss
'Highly sensitive' discs for 'fitness to practise' hearing vanish
The UK's data protection watchdog has fined the Nursing and Midwifery Council (NMC) £150,000 after it deemed its failure to encrypt sensitive personal data stored on DVDs that were lost to be a serious breach of the Data Protection Act.
The nursing and midwifery regulator had arranged for the DVDs, which contained confidential and "highly sensitive" video files relating to alleged offences by a nurse as well information about two vulnerable children, to be couriered from its offices to a 'fitness to practise' hearing in October 2011.
However, upon arrival at the hearing it was discovered that the couriered package did not contain the DVDs and which have to-date still to be recovered.
The Information Commissioner's Office (ICO) imposed a civil monetary penalty on NMC after discovering that the body had no policy in place to ensure such information was encrypted when either stored at its offices or whilst in transit.
"The Commissioner published guidance on his website in November 2007 about the risks associated with the use of unencrypted portable devices and removable media used to store or process personal data, the loss of which would be likely to cause distress to individuals," The civil monetary penalty notice served to NMC by the ICO said.
"This guidance states the Commissioner's view that such devices or media should be encrypted to protect the data, and that failure to do so may lead to enforcement action where these equipment and data are subsequently lost or misused."
"Further, it should have been obvious to [NMC] whose employees were used to handling sensitive personal data that such a contravention would be of a kind likely to cause substantial distress to the data subjects due to the nature of the data involved," it said.
Under the Data Protection Act data controllers are required to take "appropriate technical and organisational measures" to ensure against the "unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data". Deputy Information Commissioner David Smith said data encryption failings were not confined to NMC.
"It would be nice to think that data breaches of this type are rare, but we’re seeing incidents of personal data being mishandled again and again," Smith said in a statement. "While many organisations are aware of the need to keep sensitive paper records secure, they forget that personal data comes in many forms, including audio and video images, all of which must be adequately protected."
"I would urge organisations to take the time today to check their policy on how personal information is handled. Is the policy robust? Does it cover audio and video files containing personal information? And is it being followed in every case? If the answer to any of those questions is no, then the organisation risks a data breach that damages public trust and a possible weighty monetary penalty," he said.
"The Nursing and Midwifery Council’s underlying failure to ensure these discs were encrypted placed sensitive personal information at unnecessary risk," Smith added. "No policy appeared to exist on how the discs should be handled, and so no thought was given as to whether they should be encrypted before being couriered. Had that simple step been taken, the information would have remained secure and we would not have had to issue this penalty."
Copyright © 2013, Out-Law.com
Out-Law.com is part of international law firm Pinsent Masons.
Everything that is wrong with ICO...
...in one neat package.
NMC is the professional regulatory body for Nurses & Midwives. It has no shareholders, it isn't run to make a profit. Unlike previous penalties handed to local government that simply move public sector slush around, in this case the penalty is ultimately paid by nurse & midwives through their subscriptions. How does that impact those responsible? Why, in the wider context, would individuals in other organisations feel vulnerable, or motivated to improve if the only penalty is a fine that they don't pay?
Sacking should be a last resort, but there are other approaches to resolving problems. However, the ICO's fondness for monetary penalties is a subsititute for doing something useful. And since the ICO clearly aren't stopping data breaches (most of which seem to be self reported anyway), it makes me wonder if we should do away with ICO as yet another useless regulator.
When a bureaucracy (such as the public sector) or a charity/not for profit body breaches the law, the penalty needs to be something that they find organisationally uncomfortable, not some "fine" that can be hidden away in the accounts. Like forcing the head honcho and the head of IT/data protection to write to every council tax payer or member in a dedicated letter explaining what they did, what went wrong, how sorry they are, and what they are doing to ensure future compliance. In these situations, I suspect embarassment for the big wigs is a far more powerful tool than fines that they don't suffer.
Thats the real issue..
They dont think. They dont think because they know there are NO repercussions for the people involved.
Firstly, no back up of the data, secondly, its almost impossible to protect a dvd that follows normal standards. Every DVD duplication protection has been hammered into the dust.
So, the IT/Security/commen-sense devoid management should be sacked, held accountable and placed in the corner with a pointed hat.....
The case will almost now surely fail due to lack of evidence...
The only way to ensure that public sector and NFP organisations invest in due process and rigour to protect personal data is for the ICO to be able to hand down jail time to Senior Management.