Data Protection Consulting

In a series of failings related to the secure storage and/or deletion of documents containing personal information, University Hospitals Coventry and Warwickshire NHS Trust was found to have breached the Data Protection Act in October 2011 when patient information was lost on two separate occasions.  In February clinical records had been found in a communal waste bin at a residential apartment block.  In May details were found in a bin outside Coventry University Hospital.

Illustrating the need to keep an inventory when moving office, in November 2011 the Information Commissioner reported that Southwark Council had breached the Data Protection Act by misplacing a computer and some papers containing personal data during an office move.  The paperwork was later discovered in a skip.

In a good example of an incident showing personal responsibility for data security, Oliver Letwin made an undertaking to ensure that he keeps personal information secure or face formal enforcement action by the Information Commissioner.  Disposal of constituency paperwork in public bins is a breach of the Data Protection Act.  Mr Letwin singed a written commitment to ensure that any documents containing personal data are disposed of in a secure manner.

The ICO levied a monetary penalty of £130,000 on Powys County Council.  The Council was found to have committed a serious breach of the Data Protection Act when details of a child protection case were sent to the wrong recipient.  Documents were sent to the printer and then some of the pages of one report were mistakenly attached to another set of papers.  Compounding the problem, this is not the first time that this had happened at the Council.  It illustrates the need for extra care when facilities such as printers and photocopiers are shared resources.