ICO to "focus on NHS data protection and criminal justice privacy"
Posted on Wed, Jan 25, 2012
The recently published information rights strategy suggests that the ICO will put considerable focus this year on enforcing data protection in the health and criminal justice sectors. What this is likely to mean is significant sanctions for organisations where there are easily avoidable data breaches.
In the strategy, the ICO admits that it has to identify priorities whilst fulfilling its legal obligations. There are particular concerns about NHS data protection due to a legacy of data breaches. Privacy in the criminal justice sector is a concern because of initiatives such as crime mapping and the opening up of data sets.
A firmer stance on data protection
The ICO has promised a firmer stance on data breaches and has even called for custodial sentences in serious cases. This indicates that the direction of travel is towards increased sanctions in the case of sensitive data being misdirected, lost or stolen.
The ICO can currently levy a fine of up to £500,000 for data protection offences and 2011 saw a number of fines where organisations had either lost USB sticks containing sensitive data or mis-directed data by emailing it to the wrong person.
What this means for professionals
The challenge for those working in health or criminal justice is to ensure that the correct information is available to those who need it in a timely fashion. Without the correct information, essential treatment, diagnosis or trials cannot progress. For that reason, there is always a temptation to find the path of least resistance and use non-secure tools like email or standard file transfer systems. Even when they know they probably shouldn't.
We would urge professionals to be aware of the potential risks. Email is not a secure or controlled means of sending data. More importantly, human error can lead to email being misdirected. This was the most common cause of breach in the public sector in 2011.
What are the alternatives?
NHS and criminal justice organisations need to look at the tools that are straightforward and easy-to-use but built with data protection enforcement in mind.
Secure data transfer solutions that control access, use two-factor authentication and provide control and audit capabilities, can help professionals to take simple steps to prevent data breaches.
For more information or to arrange a demonstration, contact ISEEU Global now.
[image credit: http://www.channelweb.co.uk]