Nursing body fined over lost data

Britain's largest healthcare regulator has been fined by the data watchdog after it lost discs containing confidential information and evidence from vulnerable children.

The Nursing and Midwifery Council, which has 660,000 staff on its register, lost three DVDs which related to a nurse's misconduct hearing, said the Information Commissioner.

The commissioner said the discs contained "highly sensitive" information relating to offences committed by a nurse and included details of two young children.

The NMC has been fined £150,000 by the Information Commissioner for breaching the Data Protection Act.

David Smith, deputy commissioner and director of data protection, said: "It would be nice to think that data breaches of this type are rare, but we're seeing incidents of personal data being mishandled again and again.

"While many organisations are aware of the need to keep sensitive paper records secure, they forget that personal data comes in many forms, including audio and video images, all of which must be adequately protected.

"I would urge organisations to take the time today to check their policy on how personal information is handled. Is the policy robust? Does it cover audio and video files containing personal information? And is it being followed in every case?

"If the answer to any of those questions is no, then the organisation risks a data breach that damages public trust and a possible weighty monetary penalty."

In October 2011, the Nursing and Midwifery Council told contract workers to package three DVDs and send them by courier to a hearing at a hotel in Cardiff. When the packages were delivered to the hotel, the DVDs were not inside and have not been found. The discs had no encryption or additional protection.

In December, the total fines from the Information Commissioner for data breaches at councils hit £1.9 million following a series of blunders. London Borough of Lewisham was fined £70,000, Plymouth City Council was fined £60,000, Leeds City Council was fined £95,000 and Devon County Council was fined £90,000.