The Information Commissioner’s Office (ICO) has urged organisations to review their policies on how personal data is handled, after the Nursing and Midwifery Council was issued a £150,000 civil monetary penalty for breaching the Data Protection Act.
The council, which said it was “disappointed” with the ICO’s decision, lost three DVDs which related to a nurse’s misconduct hearing. An investigation found that the DVDs, which contained confidential personal information and evidence from two vulnerable children, had not been encrypted.
David Smith, deputy commissioner at the ICO said: “The Nursing and Midwifery Council’s underlying failure to ensure these discs were encrypted placed sensitive personal information at unnecessary risk.
“No policy appeared to exist on how the discs should be handled, and so no thought was given as to whether they should be encrypted before being couriered. Had that simple step been taken, the information would have remained secure and we would not have had to issue this penalty.”
The ICO urged organisations to take more care when handling personal data.
“It would be nice to think that data breaches of this type are rare, but we’re seeing incidents of personal data being mishandled again and again,” Smith added.
“While many organisations are aware of the need to keep sensitive paper records secure, they forget that personal data comes in many forms, including audio and video images, all of which must be adequately protected.
The ICO deputy commissioner stressed that organisations need to enforce robust policies when it comes to proper protection of data.
“I would urge organisations to take the time today to check their policy on how personal information is handled. Is the policy robust? Does it cover audio and video files containing personal information? And is it being followed in every case? If the answer to any of those questions is no, then the organisation risks a data breach that damages public trust and a possible weighty monetary penalty.”
