Data Protection - Breaches

Do you protect the personal data which your business holds properly?

The Data Protection Act 1998 can be complicated. In June, the Information Commissioner’s Office has said it is very concerned about breaches of data protection rights by the NHS.

[Partner’s name] a partner in [firm’s name] said:

“Last month two NHS Foundation Trusts were the latest NHS bodies found to have breached the Data Protection Act 1998. Both NHS organisations’ chief executives have had to sign formal undertakings that they will comply with the law from now on. One quarter (250) of all data breaches reported to the ICO is from the NHS but many private businesses are also at fault.

Mick Gorrill, Head of Enforcement at the ICO, said:

“Everyone makes mistakes, but regrettably there are far too many within the NHS. Health bodies must implement the appropriate procedures when storing and transferring patients’ sensitive personal information. We have taken a number of steps to explain the importance of personal data to NHS bodies and help them comply with the law. We will continue to do so.”

Two thousand paper physiotherapy records were not filed within NHS Stoke-on-Trent’s archive system and may have accidentally been destroyed or misfiled. At Basingstoke & North Hampshire NHS Trust an Excel spreadsheet, containing 917 patients’ pathology results, was emailed via an unsecure address to another department. The spreadsheet was not password protected and the receiving department had no business need to have access to the excessive amount of clinical records.

The NHS organisations concerned have agreed to implement a number of security measures to protect personal information more effectively. All staff will be made aware of the organisations’ policies for the retention and use of personal data and will receive training on how to follow those policies. NHS Stoke-on-Trent will also apply physical security measures in respect of paper medical records, particularly when they are in transit. Basingstoke & North Hampshire NHS Trust will only extract and transfer the minimum amount of personal information necessary for any processing requirement. With immediate effect, it will encrypt all portable and mobile devices used to store and transmit personal data.

Sedgwick Phelan can advise you what procedures you need in place when handling employee HR records and customer details, what you have to do to engage in lawful email marketing and what privacy policies you need on your website and in your business. Most businesses need to register and pay an annual fee to the Information Commissioner’s office under the data protection laws and fines can be heavy after they were increased earlier this year.

Call Peter Carey on 0161 653 5299 for further information.