NHS fined £375k after stolen patient data flogged on eBay

[InfoSec News <alerts () infosecnews org>]

http://www.theregister.co.uk/2012/01/13/nhs_fined_stolen_data/

By OUT-LAW.COM
The Register
13th January 2012

The Information Commissioner is proposing to issue its heaviest ever 
fine for a breach of UK data protection laws. It proposes fining a 
health body after patient records were stolen from a hospital and sold 
on eBay.

Brighton and Sussex University Hospitals NHS Trust told Out-Law.com that 
hard drives containing patient data had been sold on the auction website 
by a contractor it employed to destroy them. A spokesperson for the 
Information Commissioner's Office (ICO) said the watchdog had proposed 
fining the Trust £375,000 over the incident. The Trust has challenged 
the suggested penalty. "We were the victims of a crime," Duncan Selbie, 
chief executive of Brighton and Sussex University Hospitals NHS Trust 
said in a statement. "We subcontracted the destruction of these hard 
drives to a registered contractor who subsequently sold them on eBay."

"As soon as we were alerted to this we informed the police and with 
their help we recovered all the hard drives stolen by this individual," 
he said. "We are confident that there is a very low risk of any of the 
data from them having passed into the public domain. We have 
subsequently received a Notice from the Information Commissioner’s 
Office proposing a fine of £375,000 which we are, in the circumstances, 
challenging."

Under the Data Protection Act (DPA) organisations must take "appropriate 
technical and organisational measures ... against unauthorised or 
unlawful processing of personal data and against accidental loss or 
destruction of, or damage to, personal data". The law requires 
organisations to be extra protective over sensitive personal data, such 
as patient medical records. In a statement the ICO said it is "currently 
making inquiries into a possible breach of the Data Protection Act and 
is unable to speculate on what action will be taken at this time."

[...]

_____________________________________________________
Did a friend send you this article? Make it your
New Year's Resolution to subscribe to InfoSec News!
http://www.infosecnews.org/mailman/listinfo/isn