Information Commissioner’s Office fines Blackpool Teaching Hospital Trust for posting private details of over 6,000 of its staff members on its website

May 15, 2016 |

The Information Commissioner’s Office (the “ICO”) has imposed another swingeing fine for a breach of the Data Protection Act, on this occasion an NHS Trust publishing the national insurance numbers, dates of birth, religious beliefs and sexual orientation of 6,574 members of its staff on its web site.  As a result the Blackpool Teaching Hospitals NHS Foundation Trust has been fined £185,000.  While the breach was egregious it was inadvertent. Even so, the distinction between inadvertent and deliberate goes more to penalty rather than compliance issues.  The Trust has attracted a fine because it did not comply with the legislation.  Such enforcement action sends an important to the market, that significant breaches even caused by mistake rather than malice will attract a hit to the bottom line

The media release provides:

A health trust that posted the private details of 6,574 members of staff on its website has been fined £185,000 by the ICO.

Blackpool Teaching Hospitals NHS Foundation Trust inadvertently published workers’ confidential data including their National Insurance number, date of birth, religious belief and sexual orientation in March 2014.

The Trust failed to notice the mistake for 10 months and then took a further five months to alert affected staff.

Stephen Eckersley, Head of Enforcement at the ICO, said:

“This trust played fast and loose with the highly sensitive and private information that was entrusted to them. It seems they ignored their duty to put rules in place to protect staff who deliver hospital services to others.”

“Any measures taken to protect this information from reaching the public domain were woefully inadequate or non-existent. The fact that the error went unnoticed for so long beggars belief.”

The information was volunteered by staff as part of the Trust’s commitment to publish annual equality and diversity metrics on its website.

But the Trust failed to notice that the published spreadsheets also contained hidden data that became visible by simply double-clicking the table. This is how the personal details of individual members of staff were revealed.

Mr Eckersley said:

“There was a need for robust measures to safeguard against this kind of disclosure. I can see no good reason for that not happening and that is why we have taken action.”

The ICO’s blog “Now you don’t see it, now you do – the dangers of hidden data” was published in November 2015 alongside new guidance to give practical advice on what to look out for when providing information in different formats.

This is not the first time the ICO has fined an organisation for inadvertently publishing hidden data. Torbay NHS Trust (July 2012) and Islington Council (August 2013) both received penalties for similar mistakes.

The Monetary Penalty Notice relevantly states:

Background to the case
9. The Trust is required to publish equality and diversity metrics annually on its external website.10. On 30 January 2015, the equality and diversity lead in HRasked the electronic staff records team (“team”) for equality and diversity metrics held on the electronic staff records system (“ESR”).
11. A team member decided to search the Trust’s website to check the format of the Excel spreadsheets for 2013 so that they could be replicated .
12. He inadvertently double- clicked on a pivot table on the ‘leavers’ spreadsheet which opened up the associated data. It was discovered that the associated data to the ‘protected groups’ and ‘equality pay bands’ spreadsheets could also be accessed via a pivot table.
13. The spreadsheets contained confidential and (sensitive) personal data relating to 6,574 employees (past and present) including the employees’ name, pay scale, National Insurance number and date of birth. They also contained their ‘disabled’ status, ethnicity, religious belief and sexual orientation.
14. The spreadsheets had been publicly available on the Trust’s website for11 months. During that time, the pivot tables were accessed at least 59 times by 20 visitors. The associated data was also downloaded by persons unknown on several occasions.
15.Historically, the Trust did not have a procedure governing requests to the team for information from the ESR, which were poorly controlled. The team provided the information without being informed of its intended use or purpose.
16. On 28 February 2014, the equality and diversity lead had asked the team for the equality and diversity metrics as in previous years. The team sent the spreadsheets to the equality and diversity lead on 3 March 2014. The team had not detached the associated data because it was not aware that Excel had this feature within pivot tables.
17. The equality and diversity lead then forwarded the spreadsheets to the web services team asking it to upload them to the Trust’s website. In the absence of any guidance on what information should not be published, the web services team placed a degree of reliance on the equality and diversity lead responsible for the information.
18. Consequently, the web services team uploaded the spreadsheets and the associated data was inadvertently published on the Trust’s website on 4 March 2014.
…..
24. In particular:
(a) The Trust had in place no procedure governing requests for information from ESR to control its use and further dissemination.
(b) The Trust did not provide the team with any (or any adequate) training on the functionality of Excel spreadsheets or possible alternatives.
(c) The Trust had in place no guidance for the web services team to check the spreadsheets for hidden data before they were uploaded to its website.
25. This was an ongoing contravention from at least 4 March 2014 when the spreadsheets were uploaded to the Trust’s website until the date the security breach was discovered on 30 January 2015 and remedial action was taken.

One Response to “Information Commissioner’s Office fines Blackpool Teaching Hospital Trust for posting private details of over 6,000 of its staff members on its website”

  1. Information Commissioner’s Office fines Blackpool Teaching Hospital Trust for posting private details of over 6,000 of its staff members on its website | Australian Law Blogs May 15th, 2016

    […] Information Commissioner’s Office fines Blackpool Teaching Hospital Trust for posting private deta… […]

Leave a Reply





Verified by MonsterInsights