Information Commissioner’s Office fines a Northern Ireland nursing home for breach of data security
August 28, 2016 |
A perennial problem in data security is staff taking data off site through lap tops and bring your own devices, usually USB sticks. The problem is more than removing the data offsite though that can and is a real challenge in data management. The significant issue is ensuring data is secure when it is off site.
The Information Commissioner’s Office (the “ICO”) has issued a Monetary Penalty Notice, fining a nursing home in County Antrim, Northern Ireland, £15,000 for failing to secure sensitive personal data. The breach occurred when a staff member took her lap top home on 21 August 2014. It had personal data in it relating to 29 residents of the nursing home and 46 staff working there. Her home was burgled and the lap top was stolen. It has never been recovered.
As is often the case when the regulator looked at the circumstances of the breach a whole range of deficiencies were discovered including the nursing home not having any policies governing the use of encryption, home working and the storage of mobile devices or provide any training on data security.
The ICO found that the breach of the Act was likely to cause substantial distress being:
- mobile devices such as laptops have a high risk of loss or theft and therefore require adequate security measures to protect the personal data [26];
- when confidential and sensitive information is concerned, – in particular, as regards vulnerable elderly residents of a nursing home and its staff there is a heightened need for robust measures – in technical and organisational terms – to safeguard against unauthorised or unlawful access and accidental loss [27]
The ICO pointed out that there had been a number of high profile cases involving loss of personal information which had not been secured properly. Regarding the loss of mobile devices containing this information this had led ttwo monetary penalty notices; on 13 December 2012 (Greater Manchester Police) and 4 June 2013 (Glasgow City Council) [35].
The media release provides:
A nursing home in County Antrim has been fined £15,000 for breaking the law by not looking after the sensitive personal details in its care.
An investigation by the Information Commissioner’s Office (ICO) found widespread systemic failings in data protection at Whitehead Nursing Home at the time of a data breach.
The breach came when a member of staff took an unencrypted work laptop home, which was stolen during a burglary overnight. The laptop contained sensitive personal details relating to 46 staff including reasons for sickness absence and information about disciplinary matters. It also held some details about 29 residents including their date of birth, mental and physical health and ‘do not resuscitate’ status.
Ken Macdonald, Head of ICO Regions, said:
“This nursing home put its employees and residents at risk by failing to follow basic procedures to properly manage and look after the personal information in its care.
“Today’s fine shows we can and will act against any organisation we feel is not taking seriously its duty to look after the personal details it has been entrusted with. In a world where personal information is increasingly valuable, it is even more important to ensure the security of data is not overlooked.”
The law says organisations must have measures in place to keep the personal information they hold secure. The nursing home did not have any policies in place regarding the use of encryption, homeworking and the storage of mobile devices or provide enough data security training.
Dr Macdonald said:
“Our investigation revealed major flaws in the nursing home’s approach to data protection. Employees would have expected any details about disciplinary matters or their state of health to have been kept safe. Likewise, residents would not have expected their confidential information to have been stored on an unprotected laptop and taken to an employee’s home. Whitehead Nursing Home had totally inadequate provisions for IT security and procedure and poor data protection training.”
The issues arising out of this case are as applicable in Australia as they are in the UK. The overall standard of securing data in mobile devices is generally very poor. Without mandatory data breach notification legislation it is difficult to even approximate how that translates to data breaches.
[…] Information Commissioner’s Office fines a Northern Ireland nursing home for breach of data securit… […]