1. Action we've taken

Enforcement

33 in total

Brioney Woolfe

11 August 2017, Prosecutions, Health

A former employee of Colchester Hospital University NHS Foundation Trust, Brioney Woolfe, has been prosecuted at The Colchester Magistrates’ Court. The former Midwifery Assistant pleaded guilty to two offences under section 55 of the Data Protection Act for accessing the sensitive health records of friends and people she knew and disclosing some of the personal information obtained. Ms Woolfe was fined £400, for the offence of obtaining personal data and £650 for disclosing it, order to pay prosecution costs of £600 and a victim surcharge £65.

Cheshire West and Chester Council

10 August 2017, Undertakings, Local government

An Undertaking to comply with the seventh data protection principle has been signed by Cheshire West and Chester Council.

Royal Free London NHS Foundation Trust

03 July 2017, Undertakings, Health

The ICO has ruled the Royal Free London NHS Foundation Trust failed to comply with the Data Protection Act when it provided patient details to Google DeepMind.

Medway Council

13 June 2017, Enforcement notices, Local government

Medway Council has been issued with an enforcement notice by the Information Commissioner's Office.

Gloucester City Council

12 June 2017, Monetary penalties, Local government

The Information Commissioner’s Office has fined Gloucester City Council £100,000 after a cyber attacker accessed council employees’ sensitive personal information.

Basildon Borough Council

31 May 2017, Monetary penalties, Local government

A council has been fined £150,000 by the Information Commissioner’s Office for publishing sensitive personal information about a family.

Sally Anne Day

16 May 2017, Prosecutions, Health

A former administration employee of Crickhowell Group Practice, part of the Powys Health Trust Board, has been prosecuted at Newport Crown Court for accessing the sensitive medical records of two patients without the consent of the data controller. Ms Sally Anne Day pleaded guilty to the offence under section 55 of the Data Protection Act and was fined £400, ordered to pay costs of £350 and a victim surcharge of £40.

London Borough of Ealing

03 May 2017, Undertakings, Local government

A follow up has been completed to provide an assurance that the London Borough of Ealing has appropriately addressed the actions agreed in its undertaking signed October 2016.

Northern HSC Trust

11 April 2017, Undertakings, Health

A follow up has been completed to provide an assurance that Northern HSC Trust has or is taking action to meet the requirements of the undertaking signed July 2016 .

Eileen McMillan

05 April 2017, Prosecutions, Health

A former clerical officer employed by Portsmouth Hospitals NHS Trust, Eileen McMillan, has been prosecuted today at Portsmouth Magistrates’ Court for accessing the sensitive medical records of 2 individuals, who were estranged family members, without the consent of the data controller. The records were accessed on numerous occasions over a 5 month period, when there was no business need to do so and the individuals’ new address was obtained. Eileen McMillan pleaded guilty to the offence under section 55 of the Data Protection Act and was fined £650, which was reduced from a £1,000 fine in order to give credit for an early guilty plea, ordered to pay costs of £653.75 and a victim surcharge of £65.

Wolverhampton City Council

29 March 2017, Undertakings, Local government

A follow up has been completed to provide an assurance that Wolverhampton City Council has appropriately addressed the actions agreed in its undertaking signed June 2016.

Norfolk County Council

20 March 2017, Monetary penalties, Local government

A county council which left files that included sensitive information about children in a cabinet sent to a second hand shop has been fined £60,000 by the Information Commissioner’s Office.

Elaine Lewis

03 March 2017, Prosecutions, Health

A former nurse employed by the Hywel Dda University Health Board, Elaine Lewis, has been prosecuted at Llanelli Magistrates’ Court for accessing the sensitive medical records of over 3000 individuals, which included the records of hospital staff, without the consent of the data controller.  Elaine Lewis pleaded guilty to the offence under section 55 of the Data Protection Act and was fined £650, ordered to pay costs of £664 and a victim surcharge of £65.

HCA International Ltd

28 February 2017, Monetary penalties, Health

The Information Commissioner’s Office has fined a private health company, HCA International Ltd, for failing to keep fertility patients’ personal information secure. 

Pennine Care NHS Trust

21 February 2017, Undertakings, Health

An Undertaking to comply with the seventh data protection principle has been signed by Pennine Care NHS Trust.

Cornwall Council

17 February 2017, Undertakings, Local government

A follow up has been completed to provide an assurance that Cornwall Council has appropriately addressed the actions agreed in its undertaking signed September 2016.

NHS Digital (formerly known as HSCIC)

10 February 2017, Undertakings, Health

A follow up has been completed to provide an assurance that NHS Digital (formerly known as HSCIC) has appropriately addressed the actions agreed in its undertaking signed April 2016.

London Borough of Ealing

15 November 2016, Undertakings, Local government

An undertaking to comply with the Data Protection Act 1998 has been signed by London Borough of Ealing.

Beverley Wooltorton

25 October 2016, Prosecutions, Health

Former administrative employee Beverley Wooltorton has been prosecuted at Ipswich Magistrates’ Court for accessing personal information without a business need to do so, a criminal offence under section 55 of the Data Protection Act 1998. She pleaded guilty to accessing the medical records of people that she knew, including estranged family members, whilst employed by Ipswich Hospital NHS Trust. She was fined £650 and ordered to pay a £30 victim surcharge and £638.60 prosecution costs.

South Eastern Health and Social Care Trust

24 October 2016, Undertakings, Health

A follow up has been completed to provide an assurance that South Eastern Health and Social Care Trust has appropriately addressed the actions agreed in its undertaking signed November 2015.

Cornwall Council

04 October 2016, Undertakings, Local government

An undertaking to comply with the Data Protection Act 1998 has been signed by Cornwall Council.

Falkirk Council

12 September 2016, Undertakings, Local government

A follow up has been completed to provide an assurance that Falkirk Council has appropriately addressed the actions agreed in its undertaking signed November 2015.

Whitehead Nursing Group

25 August 2016, Monetary penalties, Health

A nursing home in County Antrim has been fined £15,000 for breaking the law by not looking after the sensitive personal details in its care.

Hampshire County Council

16 August 2016, Monetary penalties, Local government

Hampshire County Council has been hit with a £100,000 fine by the Information Commissioner’s Office after documents containing personal details of over 100 people were found in a disused building.

Regal Chambers Surgery

11 August 2016, Monetary penalties, Health

A GP practice that revealed confidential details about a woman and her family to her estranged ex-partner has been fined £40,000 by the Information Commissioner.