ICO fines Torbay Care Trust £175,000 for data gaffe

NHS trust receives penalty for publishing personal details of staff on its website

The Information Commissioner’s Office (ICO) has fined Torbay Care Trust £175,000 after accidentally publishing sensitive data about more than 1,000 trust employees on its website.

According to the ICO, staff at Torbay published the information in a spreadsheet on its website in April 2011 and only spotted the mistake when it was reported by a member of the public 19 weeks later.

The data covered the equality and diversity responses of 1,373 staff and included their names, dates of birth and National Insurance numbers, along with sensitive information about religion and sexuality.

An investigation by the ICO found that the trust had no guidance for staff on what information should not be published online and had inadequate checks to identify potential problems.

Torbay has since introduced a new web management policy intended to ensure that personal data is not mistakenly published on its website in future.

Stephen Eckersley, head of enforcement at the ICO, said: “We regularly speak with organisations across the health service to remind them of the need to look after people’s data.

“The fact that this breach was caused by Torbay Care Trust publishing sensitive information about their staff is extremely troubling and was entirely avoidable. Not only were they giving sensitive information out about their employees, but they were also leaving them exposed to the threat of identity fraud.

“While organisations can publish equality and diversity information about staff in an aggregated form, there is no justification for unnecessarily releasing their personal information. We are pleased that the trust are now taking action to keep their employees’ details secure.”

In an interview with Government Computing last month, Christopher Graham, the information commissioner, cited the NHS as having a particularly poor record on data protection.

He pointed to the large fines the ICO has imposed on health service organisations because of breaches involving the loss of memory sticks, or their contractors selling NHS hard drives on eBay.

This article is published by Guardian Professional. Join the Guardian Government Computing Network free to receive regular emails on the issues at the top of the professional agenda.

guardian.co.uk © 2012 Guardian News and Media Limited or its affiliated companies. All rights reserved. | Use of this content is subject to our Terms & Conditions | More Feeds

Enjoyed this post? Share it!

 

Leave a comment

Your email address will not be published.