September 12, 2016

A nursing home in County Antrim has been fined £15,000 for not looking after the sensitive personal details in its care.

An investigation by the ICO found widespread systemic failings in data protection at Whitehead Nursing Home at the time of the data breach.

The breach came when a member of staff took an unencrypted work laptop home, which was stolen during a burglary overnight. The laptop contained sensitive personal details relating to 46 staff including reasons for sickness absence and information about disciplinary matters.  It also held some details about 29 residents including their date of birth, mental and physical health and “do not resuscitate” status.

The ICO found that the nursing home did not have any policies in place regarding the use of encryption, homeworking and the storage of mobile devices, nor did it provide enough data security training.

The amount of the fine reflects the size of the nursing home business. A bigger organisation experiencing a similarly serious breach should expect to receive a much larger fine, the ICO says.

Ken Macdonald, Head of ICO Regions, said: “Today’s fine shows we can and will act against any organisation we feel is not taking seriously its duty to look after the personal details it has been entrusted with. In a world where personal information is increasingly valuable, it is even more important to ensure the security of data is not overlooked”.  To read the ICO’s press release in full and for a link to the monetary penalty notice, click here.