Former Health Worker fined £1,715 for obtaining and disclosing personal data
The Information Commissioner(ICO) said that the assistant had accessed the medical records of 29 people without a business purpose to do so. Some of the information was subsequently shared with others.
That was a breach of patient confidentiality and an unlawful act under the Data Protection Act. The ICO points out that those who work with personal data need to know that they can’t just access it or share it with others when they feel like it and the employer’s policy should make that clear.
We often make the point on our #DataProtection training courses that this law is not vacuum packed from other laws such as the Human Rights Act.
All personal information can lead to intrusions and interferences with people’s private lives. That can be distressing and damaging for individuals. It can give those who are in control of data a power over people in a potentially dangerous way for society and democracy. Even more so if there aren’t proper protections in place. It’s vital that data protection laws are underpinned by a respect for fundamental human rights.
That’s because the storage and use of personal information should be at the service of people. To ensure this happens, data protection laws should consider people’s right to a private life, which is protected by Article 8 of the Human Rights Convention. They also need to comply with more specific rules set out in the EU (European Union) Charter of Fundamental Rights, which protects personal data.
Article 8 requires public bodies to respect the private life of an individual and any information held about them. They must be able to justify storing or processing of any personal data. To be justified, any interference must both follow the law and have a valid purpose (there’s an exhaustive list). It must also meet a pressing social need in a way that’s proportionate. In addition, the Human Rights Convention provides that governments have a duty to ensure that national laws provide adequate protection for personal data more generally.
In addition. as we have been publicising for several months now there’s significant change on the horizon for data protection and privacy. The EU is bringing forward big new laws in this area, including the new General Data Protection Regulation (#GDPR), which will become law across the EU from 25 May 2018.
The UK is responding to this and implementing it by bringing forward the UK’s own new data protection bill. This will introduce new rules on data access, data portability, and the right to be forgotten, among many other things.
This makes it the perfect time to revisit your organisations data protection policies, ensure they are up to date and then run refresher/update training for #management and staff.
Concrew Training offers high quality low cost solutions to help you ensure your polices are robust and cascaded effectively. Read more about our popular one day workshop here
Comments
Post a Comment