Source: Information Commissioner’s Office (ICO) published on this website Thursday 2 May 2024 by Jill Powell
Information Commissioner John Edwards has condemned data protection standards at health services for people living with HIV and called for urgent improvements. The statement follows several data breaches, as well as concerns raised by some of the largest HIV organisations in the country.
Information Commissioner John Edwards said:
“People living with HIV are being failed across the board when it comes to their privacy and urgent improvements are needed across the UK. We have seen repeated basic failures to keep their personal information safe - mistakes that are clear and easy to avoid.
“Over the past few decades there have been remarkable advances in treatment and support for those living with HIV, but for people to be able to confidently use that support, they must be able to trust that when they share their personal information, it is being protected.
“We know from speaking to those living with HIV and experts in the sector that these data breaches shatter the trust in these services. They also expose people to stigma and prejudice from wider society and deny them the basic dignity and privacy that we all expect when it comes to our health.
“The ICO takes each one of these data breaches very seriously and recognises the detrimental impact they can have on the lives of those affected. We are making sure that the improvements we all want to see, such as better training, prompt reporting of personal information breaches and ending the use of BCC for sensitive communications, are being implemented as swiftly as possible.”
In the year 2022/3, the health sector accounted for over a fifth of all personal data breaches, making it the most common source of reports to the ICO.
The statement today follows another fine issued by the Information Commissioner’s Office (ICO) to a HIV service provider.
The ICO has issued a fine to The Central Young Men’s Christian Association (the Central YMCA) of London for £7,500 for a data breach where emails intended for those on a HIV support programme were sent to 264 email addresses using CC instead of BCC, revealing the email addresses to all recipients. This resulted in 166 people being identifiable or potentially identifiable. Central YMCA has now paid the fine in full.
A formal reprimand has also been issued. The fine was initially recommended to be £300,000, but this was subsequently reduced in line with the ICO's public sector approach. This approach, which the ICO is currently trialling, is where fines for public sector bodies are reduced where appropriate alongside wider use of other enforcement powers, such as reprimands. This is designed to reduce how much public money is used to pay fines for organisations’ errors, which often end up impacting those who need these public services.
The ICO has previously issued fines or reprimands for data breaches affecting people living with HIV to charity HIV Scotland and health board NHS Highland. Both of these data breaches were due to mistakes in using BCC emails for sensitive communications – something the ICO called on organisations to stop last year.
The ICO is further calling for better staff training, appropriate technical procedures and prompt reporting from HIV services.
The ICO has also been working with leading HIV and domestic abuse charities to improve the support given to people who may be in vulnerable situations and have had their data breached. More information will be shared on this work in the coming weeks.
