Home : Networking : News

ICO calls for criminal responsibility for lost laptops

The Information Commissioners' Office is looking to make fine those who knowingly or recklessly flouting data protection rules, such as a doctor losing a laptop with patient records.

By Nicole Kobie, 15 Nov 2007 at 13:31

gallery

Doctors could be held criminally responsible if they lose laptops which contain patients' records, the Information Commissioner Richard Thomas has said.

According to the Times newspaper, Thomas told the Lord's Constitution Committee that his office, the Information Commissioner's Officer (ICO), was seeking a new criminal offence for knowingly or recklessly flouting data protection principles in order to deter such incidents from happening. The punishment would be £5,000 in a magistrates' court, or an unlimited fine in Crown courts, the paper reported.

Thomas said: "If a doctor, or hospital [employee] leaves a laptop containing patients' records in his car and it is stolen, it is hard to see that is anything but gross negligence."

Several NHS trusts have had laptops earlier this year, including one containing staff details and another

holding children's addresses.

The report in the Times also said that the Ministry of Justice was looking to let the ICO monitor companies' compliance with the Data Protection Act without warning.

Alan Bentley, regional vice president of security firm Lumension, said that fines are a step in the right direction, but not enough to stop the problem of data breaches by lost or stolen laptops.

"Data protection needs to start within the surgery. Meaning, patient records that are not protected in line with data protection laws should simply not be allowed to be transferred onto mobile devices," Bentley said. "Policies can be put in place to monitor and control the flow of data, ensuring that only approved data is taken out of the doctor's surgery and that once data is released it is encrypted to ensure it can not be opened by an unapproved external source."

He said the move by the ICO would help make doctors and others more careful with their mobile devices, but wouldn't help restore public confidence in the safety of their personal data - which an earlier survey by the ICO has shown is low across the country.