WIREDGOV

The Information Commissioner’s Office (ICO) has fined a private health company, HCA International Ltd, for failing to keep fertility patients’ personal information secure.

The £200,000 monetary penalty has been issued as a result of an ICO investigation into the way the Lister Hospital was transferring, transcribing and storing records of IVF appointments.

The London hospital is part of a worldwide network of private health care facilities offering a range of services including fertility treatment. The issue was uncovered in April 2015 when a patient found that transcripts including details from interviews with Lister Hospital IVF patients could be freely accessed by searching online.

The investigation revealed the hospital had been routinely sending unencrypted audio records of the interviews by email to a company in India since 2009. Details of private conversations between a doctor and various hospital patients wishing to undertake fertility treatment were transcribed in India and then sent back to the hospital.

The ICO found the Indian company could not restrict access to the personal information because it stored audio files and transcripts using an unsecure server.

HCA International breached the Data Protection Act 1998 by failing to ensure that their sub-contractor acted responsibly.

Head of ICO enforcement, Steve Eckersley said:

“The reputation of the medical profession is built on trust. HCA International has not only broken the law, it has betrayed the trust of its patients.

“These people were discussing intimate details about fertility and treatment options and certainly didn't expect this information to be placed online.  The hospital had a duty to keep the information secure. Once information is online it can be accessed by anyone and could have caused even more distress to people who were already going through a difficult time.”

Mr Eckersley added:

“What makes this case even worse is that we know the company is aware of its data protection obligations and already has appropriate safeguards in place in other areas of its business. The situation could have been avoided entirely if HCA International had taken the time to check up on the methods used by the contract company.”

The General Data Protection Regulation (GDPR), the new data protection law coming into force in the UK in May 2018, will strengthen the ICO’s powers to fine companies. Fines of up to four per cent of a company’s global turnover could be issued where a serious breach of data protection law has occurred.

The ICO’s Practical Guide to IT Security and Encryption give advice and guidance to businesses on complying with the law and securing data.

Notes to Editors

1. Anyone who processes personal information must comply with eight principles of the Data Protection Act, which make sure that personal information is:
2. The ICO can take action to change the behaviour of organisations and individuals that collect, use and keep personal information. This includes criminal prosecution, non-criminal enforcement and audit. The ICO has the power to impose a monetary penalty on a data controller of up to £500,000.
3. The ICO has specific responsibilities set out in the Data Protection Act 1998, the Freedom of Information Act 2000, Environmental Information Regulations 2004 and Privacy and Electronic Communications Regulations 2003.
4. The Information Commissioner’s Office upholds information rights in the public interest, promoting openness by public bodies and data privacy for individuals.
   • fairly and lawfully processed;
   • processed for limited purposes;
   • adequate, relevant and not excessive;
   • accurate and up to date;
   • not kept for longer than is necessary;
   • processed in line with your rights;
   • secure;
   • and not transferred to other countries without adequate protection.
5. Civil Monetary Penalties (CMPs) are subject to a right of appeal to the (First-tier Tribunal) General Regulatory Chamber against the imposition of the monetary penalty and/or the amount of the penalty specified in the monetary penalty notice.
6. Any monetary penalty is paid into the Treasury’s Consolidated Fund and is not kept by the Information Commissioner’s Office (ICO).
7. To report a concern to the ICO telephone our helpline 0303 123 1113 or go to ico.org.uk/concerns.
8. The General Data Protection Regulation (GDPR) is a new law that will replace the Data Protection Act 1998 and will apply in the UK from 25 May 2018. The government has confirmed that the UK’s decision to leave the EU will not affect the commencement of the GDPR.