The Information Commissioner’s Office has fined the Nursing and Midwifery Council £150,000 for a breach of the Data Protection Act.

It is the second time a charity has been issued with a monetary penalty. Last year the Jewish charity Norwood was fined £70,000.

The NMC lost three unencrypted DVDs which contained confidential personal information and related to a nurse’s misconduct hearing.

David Smith, deputy commissioner and director of data protection at the ICO, said: “The Nursing and Midwifery Council’s underlying failure to ensure these discs were encrypted placed sensitive personal information at unnecessary risk.”

He explained that the ICO’s investigation revealed that: “No policy appeared to exist on how the discs should be handled, and so no thought was given as to whether they should be encrypted before being couriered. Had that simple step been taken the information would have remained secure and we would not have had to issue this penalty.”

'Isolated human error'

The incident occurred in October 2011. NMC employees were asked to package the three DVDs along with other evidence, to be couriered to a fitness-to-practise hearing being held in Cardiff. When the package was opened the DVDs were not there. There were no signs that the package had been tampered with but the DVDs have not been found.

NMC said it was a case of “isolated human error” and that it has since strengthened its policies on data protection.

In a statement the NMC said: “We regret the incident, but want to reassure the public and all our stakeholders that we recognise the importance of data protection and the need for data security.”

It added that: “Our policy, in place at the time, required encryption. We received the DVDs from the police unencrypted but we failed to encrypt them before we sent them on. We very much regret this and have now corrected our practice.”

In the past few years the NMC has been highly criticised over its management and regulation systems. Last year this culminated in a strategic review by the Council for Healthcare Regulatory Excellence which the then-CEO said would be a "catalyst for change" within the organisation.

The NMC appointed Mark Addison as chair in the summer, and he took up the role in the autumn. In September Jackie Smith, who had been interim chief executive since January 2012, was appointed chief executive for a one-year period after Addison called a halt to the open appointment process for a long-term CEO, saying that: “It is important that we have a competitive field of candidates for the key chief executive post from which to choose. In the run-up to interview it was clear this condition was no longer met.”

 

Want access to all civilsociety.co.uk content? Subscribers gain access to all expert advice, analysis, surveys, special reports and the full archive of content from as little as £43.20 per year. Find out more...