Peter A Clarke

Background

 The data controller is the UK’s regulator of nurses and midwives and part of its role is to carry out fitness to practise (“FrP”) investigations when allegations of misconduct are made against these professionals. On 7 October 2011, in preparation for a FrP hearing, administrative workers employed by the data controller were instructed to package three DVDs with other evidence and to send these by courier to the hearing venue which was a hotel in Cardiff .

 The DVDs contained confidential and highly sensitive information relating to alleged offences by a nurse and information about children who were identifiable from that information.

The courier collected the packages from the data controller’s offices on 7 October 2011 and delivered them to the hotel on 10 October .2011 as requested.   However, when the packages were opened at the hearing venue the DVDs were not inside.  The Commissioner understands that the DVDs were not protected by any form of technical security such as encryption of the video files , although the packages showed no signs of tampering.

 The data controller was aware that DVDs were used to store witness interviews used at FTP hearings from time to time and that these would often contain sensitive personal data, yet it had no policy in place requiring the encryption of this data either while held at its offices or during transit to the hearing venue.

 Following the security breach the data controller carried out extensive searches to find the DVDs but they are still missing. The data controller has now taken remedial action which included a review of its methods of exchanging sensitive information with the police. This review recommended that the data controller should put in place more formal policies and procedures regarding the security of such data , including the encryption of any data stored on removable media.

Grounds on which the Commissioner  proposes to serve a monetary penalty notice

 The relevant provision of the Act is the Seventh Data Protection Principle which provides, at Part Iof Schedule 1to the Act, that:

“Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction o0 or damage to, personal data “.

 Paragraph 9 at Part IIof Schedule 1to the Act further provides that:

 “Having regard to the state of technological development and the cost of implementing any measures, the measures must ensure a level of security appropriate to –

 (a)   the harm that might result from such unauthorised or unlawful processing or accidental/ass, destruction or damage as are mentioned in the seventh principle, and

 (b) the nature of the data to be protected”.

• The Commissioner is satisfied that there has been a serious contravention of section 4(4) of the Act.

In particular, the data controller had failed to take appropriate technical and organisational measures against accidental loss of personal data such as ensuring that any removable media containing sensitive information was encrypted prior to sending it to the hearing venue.

 The Commissioner considers that the contravention is serious because the measures did not ensure a level of security appropriate to the harm that might result from such loss and the nature of the data to be protected .

• The Commissioner is satisfied that the contravention is of a kind likely to cause substantial distress.  Confidential and highly sensitive personal data relating to vulnerable individuals was lost due to the inappropriate technical and organ isational measures taken by the data controller.

The failure to take appropriate technical and organisational measures has the potential to cause substantial distress to individuals who may know or suspect that their confidential and highly sensitive personal data has been disclosed to a recipient who has no right to see that information .

Furthermore they would be j ustifiably concerned that their data maybe further disseminated and possibly misused even if those concerns do not actually materialise.

In this context it is important to bear in mind that two of the affected individuals are vulnerable children.

• The Commissioner is satisfied that section 55A(3) of the Act applies in that the data controller knew or ought to have known that there was a  risk that the contravention would occur, and that such a contravention  would be of a kind likely to cause substantial distress, but failed to take  reasonable steps to prevent the contravention.

The Commissioner has taken this view because employees working in the data controller’s FTP directorate were used to handling sensitive personal data and the data controller was aware that sensitive information such as that on these DVDs was sent to FTP hearing panels from time to time  in an  unencrypted format.

In the circumstances, the data controller should have realised that tlhis practice of sending removable media containing sensitive personal data in an unencrypted format constituted a serious risk which could easily be avoided.

In the circumstances, the data controller knew or ought to have known that there was a risk that the contravention would occur unless reasonable steps were taken to prevent the contravention, such as ensuring that any removable media containing sensitive information was encrypted prior to sending it to the hearing venue.

The Commissioner  published guidance on his website in November 2007 about the risks associated with the use of unencrypted portable devices and removable media used to store or process personal data, the loss of which would be likely to cause distress to individuals. This guidance states the Commissioner’s  view that such devices or media should be encrypted  to protect the data, and that failure to do so may lead to enforcement action where these equipment and data are subsequently  lost or misused.

 Further, it should have been obvious to the data controller whose employees were used to handling sensitive personal data that such a contravention would be of a kind likely to cause substantial distress to the data subjects due to the nature of the data involved.

Aggravating features the Commissioner has taken into account in determin ing the amount of a monetary penalty

Nature of the contravention

• Contravention was particularly serious because of the confidential and highly sensitive nature of the personal data
• Two of the data subjects were vulnerable children

Effect of the contravention

• Three DVDs containing confident ial and highly sensitive information about alleged offences and misconduct were lost and have not been found

Impact on the data controller

• Sufficient financial resources to pay a monetary penalty up to the maximum without causing undue financial hardship

Mitigating features the Comm issioner has taken into account in determining the amount of the monetary penalty

Effect of the contravention

• To the Commissioner’s  knowledge the personal data involved has not been accessed or further disseminated

Behavioural issues

• Voluntarily reported to Commissioner’s office
  • Data controller carried out a full investigation
  • Remedial action has now been taken
  • Extensive searches were made to locate the missing DVDs
  • Co-operative with the Commissioner’s office

Impact on the data controller

• Monetary penalty will be paid out of registrant fees although the penalty will be paid into the Consolidated Fund
• Significant impact on reputation of data controller as a result of this security breach

Other considerations

• The Commissioner’s underlying objective in imposing a monetary penalty notice is to promote compliance with the Act . This is an opportunity to reinforce the need for data controllers to review the sending of confidential and sensitive personal data by unencrypted  means and to ensure that appropriate and effective security  measures are applied to the use of removable media or portable electronic devices holding such data

Notice of Intent

A notice of intent was served on the data controller dated 9 October 2012 . The Commissioner received written representations from the Solicitor acting for the data controller dated 16 November 2012 . The Commissioner has considered the written representat ions made in relation to the notice of intent when deciding whether to serve a monetary penalty notice.  In particular, the Commissioner has taken the following steps :

• reconsidered the amount of the monetary penalty generally, and whether it is a reasonable and proportionate means of achieving the objective which the Commissioner seeks to achieve by this imposition;
• ensured that the monetary penalty is within the prescribed limit of

£500,000; and

• ensured that the Commissioner is not, by imposing a monetary penalty, acting inconsistently with any of his statutory or public law duties and that a monetary penalty  notice will not impose undue financial  hardship on an otherwise responsible data controller.

Amount of the monetary pena lty

The Commissioner considers that the contravention of section 4(4) of the Act is very serious and that the imposition of a monetary penalty is appropriate.  Further that a monetary penalty in the sum of £150,000 (One hundred and fifty thousand pounds) is reasonable and proportionate given the particular facts of the case and the underlying objective in imposing the penalty .

Payment

The monetary penalty must be paid to the Commissioner’s office by BACS transfer or cheque by 15 March 2013 at the latest.  The monetary penalty is not kept by the Commissioner but will be paid into the Consolidated Fund which is the Government’s general bank account at the Bank of England.

Early payment discount

If the Commissioner receives full payment of the monetary penalty by 14 March 2013 the Commissioner will reduce the monetary penalty by 20°/o to £120,000 (One hundred and twenty thousand pounds).

Right of Appeal

There is a right of appeal to the (First-tier Tribunal) General Regulatory Chamber against:

the imposition of the monetary penalty and/or