Ouch - Torbay CT Made To Be More Than Sensitive Over Data Breach

The Information Commissioner's Office (ICO) has fined a health body a £175,000 penalty for accidentally publishing sensitive personal details of almost 1,400 NHS staff on the internet.

In April 2011 Torbay Care Trust (TCT) in Devon inadvertently published a spreadsheet to their website which contained employees' names alongside their sexual orientation, religious belief, date of birth, pay scale and their National Insurance number. The data was publicly available for 19 weeks until the mistake was reported by a member of the public.

The ICO's investigation found that there was no guidance available for staff to consult in relation to the type of data that could be published on-line. Furthermore, there was also a distinct lack of controls in place to help identify potential data breach issues.

The ICO found the blunder to be a clear breach of the Seventh Data Protection Principle, which requires organisations to have appropriate security in place in order to prevent personal data held by the organisation being accidentally or deliberately compromised.

TCT have since taken remedial action by implementing a formal process governing requests for information from the electronic staff records system together with a "management of website" policy.

The £175,000 fine is the third largest handed down by the ICO. The largest fine of £325,000 was handed down on 1 June to Brighton and Sussex University Hospitals NHS Trust, for the sale of hard drives containing highly sensitive personal data belonging to tens of thousands of patients and staff. Belfast Health and Social Care...