Nursing home fined for data breach after laptop with residents' details is stolen

A nursing home in County Antrim has been fined £15,000 for failing to adequately protect sensitive data about its staff and residents.

The Information Commissioner's Office (ICO) launched the investigation in 2014 after an unencrypted laptop, taken home by a member of staff at Whitehead Nursing Home, was stolen in a domestic burglary.

The ICO found ‘widespread systemic failings’ in data protection at the nursing home at the time.

Ken Macdonald, head of ICO regions, said: “This nursing home put its employees and residents at risk by failing to follow basic procedures to properly manage and look after the personal information in its care.

“The fine shows we can and will act against any organisation we feel is not taking seriously its duty to look after the personal details it has been entrusted with. In a world where personal information is increasingly valuable, it is even more important to ensure the security of data is not overlooked.”

The unencrypted laptop contained sensitive personal details relating to 46 staff including reasons for sickness absence and information about disciplinary matters.

Personal details of 29 residents were also held on the laptop including their date of birth, mental and physical health and ‘do not resuscitate’ status.

The law requires organisations to have measures in place to keep the personal information they hold secure. However, the nursing home did not have policies in place regarding the use of encryption, homeworking and the storage of mobile devices, or provide enough data security training for its staff.

Mr Macdonald continued: “Our investigation revealed major flaws in the nursing home’s approach to data protection. Employees would have expected any details about disciplinary matters or their state of health to have been kept safe.

“Likewise, residents would not have expected their confidential information to have been stored on an unprotected laptop and taken to an employee’s home. Whitehead Nursing Home had totally inadequate provisions for IT security and procedure and poor data protection training.”

Whitehead Nursing Home, which provides nursing and residential care for up to 39 people, said in a statement: "In response to the findings of the Information Comissioners Investigation and the monetary penalty imposed on Whitehead Nursing Home, we acknowledge that there were technical breaches of the Data Protection Act, however these were largely outside our control given that the laptop in question was stolen in a burglary from an employees home.

"We are somewhat surprised and disappointed at the ICO outcome. The laptop in question was password protected to restrict access to unauthorised persons however the technical breach was in relation to the lack of full encryption.

"We are very disappointed in their decision given that we self referred the matter, cooperated fully with the throughout the investigation process and put in place rigorous training, policies and procedures to ensure compliance with the DPA. In addition the police and all the relevant authorities were informed of the theft, and we cooperated fully with their investigations.

"At the time of the theft, staff, the clients in Whitehead Nursing home and their families were also informed of the breach. None of them have made a complaint to the company and to date we have no confirmation that an actual data or privacy breach occurred."