recent work

£1,050 fine for Personal Injury worker who used stolen personal information.

V3.co.uk has today reported that NHS Bury patients fell victim to a data theft by a personal injury worker.

Martin Campbell, who used to be employed by personal injuries firm Direct Assist, was passed stolen personal information of 29 patients of one of Bury NHS’s Primary Care walk-in centres; this data was then used to generate leads for Direct Assist over a four-month period. Campbell’s girlfriend, Dawn Makin, who worked at the walk in centre, stole the information.

Bury Primary Care Trust received complaints from patients, which subsequently led to an investigation after Campbell contacted them about their injuries, and encouraged them to make a personal injury claim.

The investigation found that Makin had accessed patient files and hadn’t been authorised to do so, before passing them to Campbell. The Information Commissioner’s Office (ICO) then got involved. Campbell was found guilty of the offence and ordered to pay a £1050 fine, £1160 in costs and a £15 victim’s surcharge.

The ICO noted that it will not take any further action against Makin, as doing so is no longer in the public interest. Information Commissioner, Christopher Graham warned:

“People’s medical information is some of their most sensitive data and they rightly expect health workers only to access it when there is a legitimate business need. Abusing this trust for personal gain is clearly wrong and potentially very distressing for those affected,” he said.

“Martin Campbell would have known that obtaining the information was unlawful and yet he put his greed ahead of people’s privacy rights. Today’s prosecution should help to serve as a deterrent to those who attempt to illegally obtain and pass on people’s information.”

Comment
Absolute Data works with many organisations to reduce or eliminate the risk to the personal information that they hold about individuals. The “softer side” of privacy risk management such as staff training and having documented procedures is often overlooked. Aside from this, organisations may not have the time, the funds or the knowledge to train staff or implement procedures to reduce the risk of instances such as this from happening.

Absolute Data can take any hassle away from an organisation, and hold training and seminars, document information, carry out regular checks and reviews on an organisation’s behalf as well as purchase, implement and manage anything relating to Data Protection. For further information, please contact us now at info@absolute-data.co.uk.