Employers should make sure temporary staff – who regularly handle personal information – receive adequate data protection training. So says the data protection watchdog, the Information Commissioner’s Office (ICO).
The regulator points to four data breaches at the Great Ormond Street Hospital for Children NHS Foundation Trust. The breaches all occurred between January 2012 and June 2013 and were caused by letters being sent to the wrong address. The letters included information about the treatment of five patients.
The ICO found that three of the incidents related to the work of temporary staff who had not received adequate data protection training, despite their role routinely involving the handling of personal information. Data protection training was in place, but was not required for temporary staff.
The London WC1-based trust also had no measures to check whether letters were being addressed to the correct recipient before sending. In some cases, the letters were seen by another member of staff before being sent, but there was no checking.
ICO Enforcement Group Manager, Sally Anne Poole, said: “This time of year often coincides with a rise in the number of temporary workers being employed across the UK. However the temporary nature of their employment doesn’t absolve employers of their legal responsibilities for making sure people’s information is being looked after correctly.
“If organisations are employing temporary or agency workers into positions that involve the handling and sending out of personal information then they must make sure these staff have received adequate data protection training. Great Ormond Street Hospital for Children NHS Foundation Trust failed to do this and have now been required to sign an undertaking with our office to improve their practices.”
For the undertaking that GOSH had to sign with the ICO, visit the ICO website.
