Brighton and Sussex University Hospitals NHS Trust was fined £325,000 by the Information Commissioner’s Office (ICO) after highly sensitive patient and staff information was discovered on hard drives sold through an online auction site.
The incident involved hard drives that had been scheduled for destruction but instead left the organisation without the data being securely removed.
The information discovered included:
- Patients’ medical conditions and treatments
- Disability Living Allowance forms and children’s reports
- Staff information including National Insurance numbers, home addresses and hospital IDs
- Information relating to criminal convictions and suspected offences
The breach occurred after an individual working for the Trust’s IT service provider was tasked with destroying around 1,000 hard drives at Brighton General Hospital in 2010. Some of the drives were instead sold, and data belonging to the Trust was later recovered from devices purchased through an online auction site.
The ICO said the size of the penalty reflected the seriousness and scale of the breach and highlighted the responsibility organisations have to keep personal information secure.
Following the incident, the Trust committed to strengthening its controls around retired IT equipment, including:
- Introducing secure storage for hard drives and other media
- Reviewing the process for vetting IT suppliers
- Using an appropriately accredited IT disposal provider
- Improving controls around access to IT equipment and data-bearing media
Although the case predates GDPR, the underlying risk remains highly relevant. Organisations need to know who is handling retired IT assets, maintain a clear chain of custody and make sure data-bearing equipment is securely erased or physically destroyed before it can be reused, resold or recycled.
Vyta’s IT Asset Disposition (ITAD) services provide secure collection, asset tracking and verified data processing throughout the disposal process. You can also view Vyta’s current security and compliance certifications.
