ICO doesn’t penalise Welsh medical practice for data breach

Where councils and the NHS are concerned, data losses seem to be as much a part of the daily routine as the morning coffee break, and afternoon gossip around the water cooler.

The latest security faux-pas has occurred at a Lampeter based medical practice, where the details of 8,000 patients have gone astray on an unencrypted memory stick.

Said stick was then posted by recorded delivery (no, we can’t quite believe it either), whereupon, surprise surprise, it went missing.

This particular incident is interesting as the Information Commissioner’s Office now has new powers to be able to levy whacking great fines of up to £500,000 for breaches of the Data Protection Act.

But despite the ICO acknowledging that this medical practice had indeed contravened the Act, it neglected to fine the organisation.

Instead, the Lampeter practice has got the standard telling off, don’t do it again routine. Steps will be taken to ensure this doesn’t happen again, yada yada yada (despite the fact that a policy was already in place whereby this shouldn’t have happened, anyway).

Evidently the ICO doesn’t consider a compromise to the tune of 8,000 people a big enough incident to weigh in with even a smaller penalty to make an example.

We thought this one was worse than the norm seeing as the stick wasn’t even lost accidentally as is usually the case, but through posting it via the normal mail, a pretty daft decision.

Perhaps the ICO thinks that the threat of a potential fine is enough for now. Although we guess a bigger incident is bound to be along soon enough, and we’ll have to see if the knives get sharpened then.