Enforcement action

Nilesh Morar

21 September 2017, Prosecutions, Local government

Nilesh Morar has been prosecuted at Nuneaton Magistrates’ Court for the offence of unlawfully obtaining personal data.

A former data co-ordinator employed by The University Hospitals of North Midlands NHS Trust has been prosecuted at North Staffordshire Magistrates’ Court. Linda Reeves accessed the sensitive medical records of colleagues as well as people she knew that lived in her locality, without the consent of the data controller. Ms Reeves pleaded guilty to the offence under section 55 of the Data Protection Act and was fined £700, ordered to pay costs of £364.08 and a £70 Victim Surcharge.

Nottinghamshire County Council

31 August 2017, Monetary penalties, Local government

A council has been fined £70,000 by the Information Commissioner’s Office for leaving vulnerable people’s personal information exposed online for five years.

London Borough of Islington

17 August 2017, Monetary penalties, Local government

Islington Council failed to keep up to 89,000 people’s information secure on its parking ticket system website. That was the conclusion of an Information Commissioner’s Office investigation which has resulted in a £70,000 fine for the London borough.

Brioney Woolfe

11 August 2017, Prosecutions, Health

A former employee of Colchester Hospital University NHS Foundation Trust, Brioney Woolfe, has been prosecuted at The Colchester Magistrates’ Court. The former Midwifery Assistant pleaded guilty to two offences under section 55 of the Data Protection Act for accessing the sensitive health records of friends and people she knew and disclosing some of the personal information obtained. Ms Woolfe was fined £400, for the offence of obtaining personal data and £650 for disclosing it, order to pay prosecution costs of £600 and a victim surcharge £65.

Cheshire West and Chester Council

10 August 2017, Undertakings, Local government

An Undertaking to comply with the seventh data protection principle has been signed by Cheshire West and Chester Council.

Royal Free London NHS Foundation Trust

03 July 2017, Undertakings, Health

The ICO has ruled the Royal Free London NHS Foundation Trust failed to comply with the Data Protection Act when it provided patient details to Google DeepMind.

Medway Council

13 June 2017, Enforcement notices, Local government

Medway Council has been issued with an enforcement notice by the Information Commissioner's Office.

Gloucester City Council

12 June 2017, Monetary penalties, Local government

The Information Commissioner’s Office has fined Gloucester City Council £100,000 after a cyber attacker accessed council employees’ sensitive personal information.

Basildon Borough Council

31 May 2017, Monetary penalties, Local government

A council has been fined £150,000 by the Information Commissioner’s Office for publishing sensitive personal information about a family.

Sally Anne Day

16 May 2017, Prosecutions, Health

A former administration employee of Crickhowell Group Practice, part of the Powys Health Trust Board, has been prosecuted at Newport Crown Court for accessing the sensitive medical records of two patients without the consent of the data controller. Ms Sally Anne Day pleaded guilty to the offence under section 55 of the Data Protection Act and was fined £400, ordered to pay costs of £350 and a victim surcharge of £40.

London Borough of Ealing

03 May 2017, Undertakings, Local government

A follow up has been completed to provide an assurance that the London Borough of Ealing has appropriately addressed the actions agreed in its undertaking signed October 2016.

Northern HSC Trust

11 April 2017, Undertakings, Health

A follow up has been completed to provide an assurance that Northern HSC Trust has or is taking action to meet the requirements of the undertaking signed July 2016 .

Eileen McMillan

05 April 2017, Prosecutions, Health

A former clerical officer employed by Portsmouth Hospitals NHS Trust, Eileen McMillan, has been prosecuted today at Portsmouth Magistrates’ Court for accessing the sensitive medical records of 2 individuals, who were estranged family members, without the consent of the data controller. The records were accessed on numerous occasions over a 5 month period, when there was no business need to do so and the individuals’ new address was obtained. Eileen McMillan pleaded guilty to the offence under section 55 of the Data Protection Act and was fined £650, which was reduced from a £1,000 fine in order to give credit for an early guilty plea, ordered to pay costs of £653.75 and a victim surcharge of £65.

Wolverhampton City Council

29 March 2017, Undertakings, Local government

A follow up has been completed to provide an assurance that Wolverhampton City Council has appropriately addressed the actions agreed in its undertaking signed June 2016.

Norfolk County Council

20 March 2017, Monetary penalties, Local government

A county council which left files that included sensitive information about children in a cabinet sent to a second hand shop has been fined £60,000 by the Information Commissioner’s Office.

Elaine Lewis

03 March 2017, Prosecutions, Health

A former nurse employed by the Hywel Dda University Health Board, Elaine Lewis, has been prosecuted at Llanelli Magistrates’ Court for accessing the sensitive medical records of over 3000 individuals, which included the records of hospital staff, without the consent of the data controller. Elaine Lewis pleaded guilty to the offence under section 55 of the Data Protection Act and was fined £650, ordered to pay costs of £664 and a victim surcharge of £65.

HCA International Ltd

28 February 2017, Monetary penalties, Health

The Information Commissioner’s Office has fined a private health company, HCA International Ltd, for failing to keep fertility patients’ personal information secure.

Pennine Care NHS Trust

21 February 2017, Undertakings, Health

An Undertaking to comply with the seventh data protection principle has been signed by Pennine Care NHS Trust.

Cornwall Council

17 February 2017, Undertakings, Local government

A follow up has been completed to provide an assurance that Cornwall Council has appropriately addressed the actions agreed in its undertaking signed September 2016.

NHS Digital (formerly known as HSCIC)

10 February 2017, Undertakings, Health

A follow up has been completed to provide an assurance that NHS Digital (formerly known as HSCIC) has appropriately addressed the actions agreed in its undertaking signed April 2016.

Keketso Monnapula

02 December 2016, Prosecutions, Health

A former agency admin worker of Tees Esk & Wear Valleys NHS Foundation Trust, Keketso Monnapula, has been prosecuted at Harrogate Magistrates’ Court for accessing the sensitive medical records of people that she knew, such as old school friends and a family member, without the consent of the data controller. Ms Monnapula pleaded guilty to the offence under section 55 of the Data Protection Act and was fined £45, ordered to pay costs of £405.98 and a £40 victim surcharge of £20.

London Borough of Ealing

15 November 2016, Undertakings, Local government

An undertaking to comply with the Data Protection Act 1998 has been signed by London Borough of Ealing.

Kayleigh Evans

28 October 2016, Prosecutions, Health

A former administrative employee of Solent NHS Trust, Kayleigh Evans, has been prosecuted at West Hampshire Magistrates’ Court for accessing the sensitive medical records of a former girlfriend of her partner, without the consent of the data controller. The unlawful accesses to the records were over a 10 month period. Ms Evans pleaded guilty to the offence under section 55 of the Data Protection Act and was fined £400, ordered to pay £683.60 prosecution costs and a £40 victim surcharge.

Beverley Wooltorton

25 October 2016, Prosecutions, Health

Former administrative employee Beverley Wooltorton has been prosecuted at Ipswich Magistrates’ Court for accessing personal information without a business need to do so, a criminal offence under section 55 of the Data Protection Act 1998. She pleaded guilty to accessing the medical records of people that she knew, including estranged family members, whilst employed by Ipswich Hospital NHS Trust. She was fined £650 and ordered to pay a £30 victim surcharge and £638.60 prosecution costs.