Public Health Wales statement on Data breach
Public Health Wales regrets to announce that there has been a data breach involving the personally identifiable data of Welsh residents who have tested positive for COVID-19.
A risk assessment has been conducted and legal advice has been sought, both of which advise that the risk of identification of the individuals affected by this data breach appears low.
The incident, which was the result of individual human error, occurred on the afternoon of 30 August 2020 when the personal data of 18,105 Welsh residents who have tested positive for COVID-19 was uploaded by mistake to a public server where it was searchable by anyone using the site. After being alerted to the breach we removed the data on the morning of 31 August. In the 20 hours it was online it had been viewed 56 times.
In the majority of cases (16,179 people) the information consisted of their initials, date of birth, geographical area and sex meaning that the risk they could be identified is low. However, for 1,926 people living in nursing homes or other enclosed settings such as supported housing, or residents who share the same postcode as these settings, the information also included the name of the setting. The risk of identification for these individuals therefore is higher but is still considered low.
There is no evidence at this stage that the data has been misused. However, we recognise the concern and anxiety this will cause and deeply regret that on this occasion we have failed to protect Welsh residents’ confidential information. Anyone concerned that their data or that of a close family member may have been breached and wanting advice should firstly read the FAQs at www.phw.nhs.wales then email us at PHW.firstname.lastname@example.org if they have any additional questions. People can also call Public Health Wales on 0300 003 0032 to discuss their concerns.
The Information Commissioner's Office and Welsh Government have been informed and we have commissioned an external investigation into the full circumstances surrounding the data breach and any lessons to be learned. The investigation is being led by the Head of Information Governance at the NHS Wales Informatics Service.
In the meantime, we have taken immediate steps to prevent a similar incident from happening again. These include establishing an Incident Management Team to instigate remedial actions which have already resulted in changes to our standard operating procedures so that any data uploads are now undertaken by a senior member of the team. We have also informed our health board and local authority partners and have kept them up to date with the position.
Tracey Cooper, Chief Executive of Public Health Wales recently said,
“We take our obligations to protect people’s data extremely seriously and I am sorry that on this occasion we failed. I would like to reassure the public that we have in place very clear processes and policies on data protection. We have commenced a swift and thorough external investigation into how this specific incident occurred and the lessons to be learned. I would like to reassure our public that we have taken immediate steps to strengthen our procedures and sincerely apologise again for any anxiety this may cause people.”
Latest News from
Public Health Wales statement on JCVI advice on AstraZeneca COVID-19 vaccine10/05/2021 11:15:00
Public Health Wales statement on JCVI advice on AstraZeneca COVID-19 vaccine (07 May 2021).
Public Health Wales Board changes26/04/2021 14:15:00
In March, the Minister for Health and Social Services made two announcements concerning Public Health Wales’ Board membership.
Swansea Bay to support new UK trial for COVID-19 vaccine22/04/2021 12:15:00
Swansea Bay University Health Board and Public Health Wales are looking for volunteers to participate in the latest clinical trial studying a vaccine against COVID-19.
Public Health Wales statement on safety concerns with AstraZeneca COVID-19 vaccine12/04/2021 15:15:00
Public Health Wales supports the expert scientific advice of UK expert groups that the benefits of vaccination with all COVID-19 vaccines in use continue to outweigh the risks of COVID-19.
Forthcoming changes to the way we publish Coronavirus information06/04/2021 14:15:00
Public Health Wales is making some changes to the way we publish information on our website and data dashboard.
Pre-election period working: The Communicable Disease Surveillance Centre25/03/2021 16:38:00
The Communicable Disease Surveillance Centre (Wales) (CDSC) has been providing epidemiology, disease surveillance, outbreak investigation, research and training for Wales since the 1980s, initially as part of the Public Health Laboratory Service (PHLS), then from 2003 in the National Public Health Service for Wales (NPHS) and since 2009 as part of the Health Protection Division of Public Health Wales.
New report finds planning ahead key to self-isolation success25/03/2021 14:15:00
A new report from Public Health Wales’ Research and Evaluation Division, has found people who have identified sufficient support and planned ahead for a potential period of self-isolation, feel less challenged by the prospect and more likely to succeed.
Placing Health Equity at the heart of Coronavirus recovery for building a sustainable future for Wales19/03/2021 09:15:00
A new report published yesterday (18 March 2021) calls for a greater emphasis on health equity – ensuring everyone has an equal opportunity to be healthy – in the response to, and recovery from, Coronavirus.
New study finds Coronavirus transmission highest in households and hospitality17/03/2021 16:15:00
A study published recently (15 March 2021) from Public Health Wales, which looks at the evidence from mass testing in Merthyr Tydfil and the Cynon Valley, suggests that households are the most significant source of infection, while working in the hospitality sector or visiting the pub are also significant risks.