ICT for Recovery

Ipswich doctor agrees to improve security after breaching the Data Protection Act

The ICO has found Dr Thomas in breach of the Data Protection Act after a practice computer server was found in the car park by an employee of Suffolk Primary Care Trust. The server contained the sensitive personal information of a large number of the practice's patients and some personal data of its employees.

Dr Thomas has agreed to ensure that the decommissioning process regarding the practice's servers has been completed successfully to maintain the security of personal information. He also undertook to ensure that any other appropriate electronic equipment holding personal information would be decommissioned appropriately.

Sally-anne Poole, Head of Enforcement and Investigations at the ICO, said: 'It is vital that sensitive personal information, such as patient information, is handled securely. This is an important principle of the Data Protection Act. I am pleased that Dr Thomas is taking remedial action to improve data security.'

Anyone who processes personal information must comply with eight principles, which make sure that personal information is:
a) Fairly and lawfully processed
b) Processed for limited purposes
c) Adequate, relevant and not excessive
d) Accurate and up to date
e) Not kept for longer than is necessary
f) Processed in line with your rights
g) Secure
h) Not transferred to other countries without adequate protection