As a result of breaching data protection laws, the Torbay Care Trust has been fined £175,000 by the ICO. A spreadsheet containing "sensitive" information about the employees' religion and sexuality; as well as names, dates of birth and national insurance numbers was published on to their website. The ICO said that such information was likely to cause substantial damage and/or distress to those who had had their details exposed. What is more, head of enforcement with the ICO, Stephen Eckersley, highlighted that the release of such information put staff at risk of being victims of identity fraud. The breach only came to light when a member of the public reported it 19 weeks after it was posted, the ICO said.
The Data Protection Act (DPA) requires organisations to exercise the appropriate organisational measures to eliminate the risk of such sensitive information being used without authorisation. This includes the need to have "effective policies and procedures in place to control its use and further dissemination". Organisations may publish equality and diversity information about staff in an aggregated form, but the publication of their personal information in such a way is strictly prohibited.
Head of the Trust at the time of the incident, Anthony Farnsworth, attributed the breach of the DPA to a lack of organisation due to minimal checks within its processes. The data protection watchdog carried out an investigation and concluded that the Trust did not provide guidance for staff as to what information can be published online. They also were found to not have adequate check in place to identify potential problems.
The watchdog acknowledged the steps the Trust has taken since the incident in order to avoid such a breach in the future. Farnsworth explained that they have now implemented more robust procedures for managing staff information to overcome such risks. Although disappointed by the large fine, the organisation accepts the conclusion the ICO came to. Provisions have been made so the fine can be paid without need to cut budgets for staff or health and social care.
© Brian Miller, solicitor, 2012.
Brian can be contacted at Stone King, Solicitors. For further news and information on legal topics of interest, please visit Brian's other blogs: