Recently, the UK Information Commissioner's Office (the "ICO") has issued monetary penalties to two National Health Service ("NHS") bodies, for serious breaches of the Data Protection Act 1998 (the "DPA").

The Aneurin Bevan Health Board (the "ABHB") was fined £70,000 for mistakenly sending a letter containing the sensitive personal data of one patient to another with a near identical name.  Similarly, the Central London Community Healthcare ("CLCH") NHS Trust was fined £90,000 for repeatedly sending patient lists containing the sensitive personal data of 59 patients intended for St John's Hospice to the wrong recipient. As well as these specific failures, the ICO found that both the ABHB and the CLCH had failed to train their employees in the requirements of the DPA and had inadequate systems in place to prevent data protection breaches.

The ICO has the power to fine organizations up to £500,000 for serious breaches of the DPA, however these are the first fines issued to NHS organizations. Previously the ICO has required undertakings from NHS organizations following data protection breaches, but is now signaling an intention to pursue offending bodies more vigorously. In announcing the ABHB's fine, Stephen Eckersley, the ICO's Head of Enforcement, said "the health service holds some of the most sensitive information available… organizations across the health service must stand up and take notice of this decision if they want to avoid future enforcement action from the ICO."

For the ICO's press release relating to the ABHB, click here.  For the ICO's press release relating to the CLCH NHS Trust, click here.  Rod Lambert and Nicola Birney