ICO reports significant data breaches

There has been a significant increase in the number of data breaches during the last three months, according to the Information Commissioner’s Office.

Ninety-nine incidents in the public and private sector have been reported to the privacy watchdog during the period of November 2008 to the end of January 2009. This compares to 277 breaches reported in the previous 12 months.

The highest number of breaches in the public sector occurred within the NHS and other health authorities, with 27 breaches during the last three months. The total number of reported breaches in this sector now stands at 102 since November 2007.

Since January, the ICO has already taken enforcement action against three NHS Trusts for breach of the Data Protection Act: Brent Teaching Primary Care Trust, Abertawe Bro Morgannwg University NHS Trust and Tees, Esk and Wear Valleys NHS Foundation Trust.

The ICO has required all three trusts to sign a formal undertaking agreement that they will encrypt all data in future and improve security in line with the Data Protection Act.

Central and local government are both responsible for a further 18 breaches in the past three months, with a total of 46 and 44 breaches respectively since November 2007.

However, private companies were also guilty of a rise in serious breaches. The ICO has now logged a total of 112 breaches from November 2007 until January this year, with 32 new incidents reported in the past three months.

In one instance personal information, including credit card slips, was thrown out unshredded by Woolworth’s staff, just before the high street retailer collapsed last month.

The ICO warned that organisations that fail to take data protection seriously risk losing the trust and confidence of the public. It will update the logs of breaches every three months, with the next update due in April.