WIREDGOV

Bayswater Medical Centre (BMC) in London has been fined £35,000 by the Information Commissioner’s Office (ICO) after it left highly sensitive medical information in an empty building.

The personal data, which included medical records, prescriptions and patient-identifiable medicine, was left unsecured in the building for more than 18 months.

In July 2015, BMC moved out of a former GP surgery but continued to use the premises for storage purposes.

In 2016, representatives of another GP surgery were allowed to visit the vacant building with a view to taking over the lease.

Once inside, they found unsecured medical records and other sensitive information and informed BMC, but the owners took no action to secure the data, despite repeated warnings by both the other surgery and the local Clinical Commissioning Group.

In February 2017, officers from NHS England visited the site and found a large quantity of highly sensitive information left on desks, in unlocked cabinets and in bins. They ordered BMC to remove the information the next day.

Steve Eckersley, the ICO’s Head of Enforcement, said

“Bayswater Medical Centre left their patients’ most sensitive data abandoned and with no thought for the distress that this could cause them if it had been lost or misused.”

The ICO ruled that:                  

• BMC failed to secure the premises or the data stored there, and allowed unsupervised access to the premises by others, who were not authorised to view the data;
• BMC should have known that that exposing this highly sensitive personal information – and potentially losing it -would have caused substantial damage and distress; and
• The contravention was heightened by BMC’s failure to take prompt action to protect patient data for such a long time.

The ICO found that the severity of the breach merited a fine of £80,000, but this was reduced to £35,000 after BMC’s ability to pay was taken into account.

Mr Eckersley said:

“It is our duty to stand up for people’s data rights and to ensure that their sensitive personal information is protected.

“Out of sight is definitely not out of mind. We don’t want anyone to think that they can avoid the law or their duties by abandoning personal data in empty buildings.”

Notes to Editors

1. The Information Commissioner’s Office upholds information rights in the public interest, promoting openness by public bodies and data privacy for individuals.
2. The ICO has specific responsibilities set out in the Data Protection Act 1998, the Freedom of Information Act 2000, Environmental Information Regulations 2004 and Privacy and Electronic Communications Regulations 2003.
3. The ICO can take action to change the behaviour of organisations and individuals that collect, use and keep personal information. This includes criminal prosecution, non-criminal enforcement and audit. The ICO has the power to impose a monetary penalty on a data controller of up to £500,000.
4. The European Union’s General Data Protection Regulation (GDPR) is a new law which will apply in the UK from 25 May 2018. The Government has confirmed the UK’s decision to leave the EU will not affect the commencement of the GDPR. The Government is introducing measures related to this and wider data protection reforms in a Data Protection Bill.
5. Anyone who processes personal information must comply with eight principles of the Data Protection Act, which make sure that personal information is:
   • fairly and lawfully processed;
   • processed for limited purposes;
   • adequate, relevant and not excessive;
   • accurate and up to date;
   • not kept for longer than is necessary;
   • processed in line with your rights;
   • secure; and
   • not transferred to other countries without adequate protection.
6. Civil Monetary Penalties (CMPs) are subject to a right of appeal to the (First-tier Tribunal) General Regulatory Chamber against the imposition of the monetary penalty and/or the amount of the penalty specified in the monetary penalty notice.
7. Any monetary penalty is paid into the Treasury’s Consolidated Fund and is not kept by the Information Commissioner’s Office (ICO).
8. To report a concern to the ICO telephone our helpline 0303 123 1113 or go to ico.org.uk/concerns.