Information safety fears as personal data is lost

FRESH fears have been raised over the protection of personal information after both the city council and NHS Lothian were hit by new "data loss" incidents.

The Evening News has uncovered a series of cases where sensitive information has been lost or stolen in the past year.

They range from medical records blowing away in a gust of wind, to the personal information of 50 people being "lost in transit" between council offices.

Health board and council chiefs today insisted they took data protection very seriously but there were calls for more to be done to ensure such cases cannot happen again.

The Evening News can reveal that a computer memory stick containing personal information of at least 50 people was lost while being transported between two council offices last October. The council will not say what kind of data was on it but said it was investigating how it happened.

A second memory stick was lost less than a month later, although the council said that there was a "very limited" amount of personal information stored on it.

NHS Lothian has reported nine cases in the past year. In May notes containing details of appointments were blown on to a road by an unexpected gust of wind. Not all notes were recovered.

Two months later an old filing cabinet was crushed and taken to landfill with notes still inside, and in August a doctor's handover sheet was discovered on a ramp leading to the Sick Kids hospital.

Health chiefs have pointed out that for the nine incidents reported, more than one million patients went through the system in 2009. And they said there had been a crackdown since the high-profile loss of a data stick with the information of 137 patients in 2008.

Cllr Iain Whyte, leader of the Conservative group on the city council and also an NHS Lothian board member, said the local authority should introduce a blanket ban on memory sticks as the health board has done.

"If personal data is still being put on memory sticks, then being lost or stolen, it does beg the question of whether enough is being done. If there is not a blanket ban on transporting data in that way then there should be," he said.

Figures also show that eight computers, a hard drive, two laptops and two memory sticks have been lost or stolen on council property in the last year.

Cllr Phil Wheeler, the city's finance leader, said: "All security incidents of this nature are carefully analysed to allow us to take any appropriate action.

Alan Boyter, NHS Lothian's director of human resources and organisational development, said: "NHS Lothian ran a major data safety awareness campaign

involving a data amnesty which allowed people to safely dispose of data sticks and discs."

MISSING YOU

THE new "data loss" incidents are far from the only cases in the past few years.

It is an issue that has been highlighted regularly in the Lothians since the case of a missing NHS Lothian data stick in 2008.

Two computers were then stolen from a council office in February 2009, followed by another four in June from a school. An external hard drive used to store e-mail archives was stolen from a council office in April.

In May, an army laptop containing the personal details of serving soldiers and their families was stolen from a car near a city barracks.

Peter Gabbitas, the council's director of health and social care, had his laptop taken from an open plan office in Waverley Court, along with another laptop and a sum of money in the summer.