A nursing home in County Antrim has been fined £15,000 by the UK data protection watchdog, for breaking the law by not looking after the sensitive personal details in its care. The Information Commissioner’s Office (ICO) found what it called widespread systemic failings in data protection at Whitehead Nursing Home at the time of a data breach.
The breach came when a member of staff took an unencrypted work laptop home, which was stolen during a burglary overnight. The laptop contained sensitive personal details relating to 46 staff including reasons for sickness absence and information about disciplinary matters. It also held some details about 29 residents including their date of birth, mental and physical health and ‘do not resuscitate’ status.
Ken Macdonald, Head of ICO Regions, said: “This nursing home put its employees and residents at risk by failing to follow basic procedures to properly manage and look after the personal information in its care. Today’s fine shows we can and will act against any organisation we feel is not taking seriously its duty to look after the personal details it has been entrusted with. In a world where personal information is increasingly valuable, it is even more important to ensure the security of data is not overlooked.”
The ICO points out that according to the Data Protection Act, organisations must have measures in place to keep the personal information they hold secure. The nursing home did not have any policies in place regarding the use of encryption, homeworking and the storage of mobile devices or provide enough data security training.
Dr Macdonald said: “Our investigation revealed major flaws in the nursing home’s approach to data protection. Employees would have expected any details about disciplinary matters or their state of health to have been kept safe. Likewise, residents would not have expected their confidential information to have been stored on an unprotected laptop and taken to an employee’s home. Whitehead Nursing Home had totally inadequate provisions for IT security and procedure and poor data protection training.”
The ICO added that the amount of the fine reflected the size of the nursing home business. A bigger organisation experiencing a similarly serious breach should expect to receive a much larger fine, the watchdog warned.
Comment
Neil Fraser, Head of Comms and Space at security and communication product company ViaSat UK said: “The facts of this breach show that the message is still not getting through on data protection: in particular, we cannot rely on individuals knowing how to deal with sensitive data. The industry needs to do more to meet their obligations to securely handle personal information and organisations such as this need to ensure that they are providing effective education to staff. The ICO can only do so much when it comes to providing guidance and subsequently fining offenders; organisations need to start taking data protection seriously and protect the often very sensitive data they hold. This case is particularly concerning given the nature and the fact it included information on residents’ mental and physical health.”
