Peter A Clarke

Organisations and agencies that collect and use personal information have a chronic problem of staff accessing that information without authorisation.   It is a very significant problem in the health industry with staff looking into the health records of celebrities; George Clooney in 2007, of Brittany Spears in 2008, Michael Jackson’s health records in 2011 and Kim Kardashian in 2013 to name a few. Last year 2 staff members at the Ipswich Hospital were reprimanded and one sacked for accessing Ed Sheeran’s health records relating to his treatment for a writs injury caused by a bicycle accident.  These instances are a fraction of the breaches of this nature that occurs. The breaches rarely come to light because the organisations notify those whose personal information have been compromised.  And they are only occasionally notified to the regulator. 

A case of snooping that was reported to the regulator resulted in a successful prosecution. In the United Kingdom unauthorised access of personal information is criminal offence. The UK Information Commissioner successfully prosecuted a former customer services officer at Stockport Homes who unlawfully accessed personal data, being anti social behaviour cases 67 times in 2017.  The breaches were discovered by an audit which was undertaken during a review of this persons’ performance. Often times it is another matter being investigated that results in the discovery of poor data practices. That highlights a weakness in an organisation’s data security.  A proper data security system should have highlighted the breach at the time of the access.  Better practice would have been requiring some form of sign in with an identifier and if the person was not an approved viewer of the data some notification should be made to the IT department.  To minimise those sorts of breaches some form of password protection for files of this nature would be advisable. 

The ICO’s media release provides:

A former customer services officer at Stockport Homes Limited (SHL) has been found guilty of unlawfully accessing personal data without a legitimate reason to do so.

Wendy Masterson spent time looking at anti social behaviour cases on SHL’s case management system when she wasn’t authorised to do so. She accessed the system a total of 67 times between January and December 2017.

The offences came to light following an audit of Masterson’s access to SHL’s case management system, after concerns were raised regarding her performance, which resulted in Masterson’s suspension and her subsequent resignation.

Masterson, of Middlesex Road, Stockport pleaded guilty to unlawfully accessing personal data in breach of s55 of the Data Protection Act 1998 at Stockport Magistrates Court on 6 June 2019. She was ordered to pay a £300 fine, £364.08 costs and a victim surcharge of £30.

Mike Shaw, Group Manager Enforcement at the Information Commissioner’s Office, which brought the prosecution, said:

“People have the absolute right to expect that their personal information will be treated with the utmost privacy and in strict accordance with the UK’s data protection laws.

“Our prosecution of this individual should act as a clear warning that we will pursue and take action against those who choose to abuse their position of trust.

In Ireland a DPP Employee has been sentenced to 11 months imprisonment for disclosing sensitive information about the arrest of a suspect.  The Irish Times story provides:

A civil servant in the office of the Director of Public Prosecutions (DPP) has been been given an 11-month sentence for disclosing sensitive information about the arrest of a suspect in a dissident republican murder case.

Service officer Jonathan Lennon (35) from Clonee, Dublin 15, who admitted having a “nosey” in the Peter Butterly murder file, was jailed on Friday – but released within minutes after lodging a notice of appeal.

He had pleaded not guilty to breaking the Official Secrets Act in connection with criminal proceedings resulting from the 2013 murder of the dissident republican Butterly during an internal feud in the IRA.

Lennon, a married father-of-three, who has been suspended from work pending his trial, was accused of four counts of disclosing information without authorisation to three named men about the arrest of a suspect, on September 7th, 2017 and the following day.

He was convicted by Judge John Hughes following his eight-day non-jury trial, at Dublin District Court last month.

He returned to court on Friday for sentencing. Judge Hughes imposed consecutive sentences totalling 11-months with the final month suspended.

He said he had to take into account the breach of trust and the reputational damage to the offices of the DPP.

Appeal bail in Lennon’s own bond of €1,000 was set by the court and was taken up minutes after the jail term was handed down.

This means Lennon, who remained silent throughout his hearing, will challenge the outcome of the case in the circuit court on a later date.

Pleading for leniency, Seamus Clark SC, defending, asked Judge Hughes to take into account that it was a case of “loose lips” from temptation rather than a plan to actively gather information.

Lennon was a staunch republican but that was not a crime, counsel said. He knew others who were also republican and who had gone further but he was not well disposed to the person who benefited from the leaked information.

The case had a placed a strain on his family life and will affect his employment, counsel said.

The case followed an investigation by the Garda Special Detective Unit.

Lennon did not give evidence in his trial, which heard one of the people he had contacted and bought Irish Republican Prisoner Welfare Association badges from on September 7th was Damien Metcalfe.

Metcalfe (33) with an address at Blackditch Road, Ballyfermot, Dublin, was jailed for two years and six months, last week, after he was convicted by the Special Criminal Court of IRA membership on a date in 2015.

Four other men are serving life sentences for the murder of Peter Butterly.