The Information Commissioner’s Office (ICO) issued the Nursing and Midwifery Council with a £150,000 civil monetary penalty after three DVDs containing confidential personal information were lost while being transported to a hearing.
The discs contained sensitive information and evidence relating to two vulnerable children. An ICO investigation found that the information had not been encrypted, leaving the data exposed when the DVDs went missing.
David Smith, then Deputy Commissioner and Director of Data Protection at the ICO, highlighted that personal data can exist in many forms and that organisations need appropriate safeguards for digital media as well as paper records.
The Nursing and Midwifery Council had been couriering the evidence to a fitness-to-practise hearing. The DVDs were never recovered, and the ICO concluded that the failure to encrypt them had placed sensitive personal information at unnecessary risk.
Although this case predates GDPR, the underlying lesson remains relevant: organisations need to understand where sensitive data is stored and ensure it remains protected throughout its lifecycle.
This is particularly important when IT equipment reaches the end of its useful life. Laptops, desktops, servers, hard drives and other data-bearing assets can retain sensitive information unless they are securely erased or destroyed and handled through a controlled chain of custody.
Learn more about Vyta’s IT Asset Disposition (ITAD) services and how organisations can securely manage retired IT assets from collection through to final outcome.
