Documents discovered in second-hand furniture shop
The Belfast Trust is investigating how documents — some marked “strictly confidential” — belonging to a former employee were discovered abandoned in a charity shop.
The Information Commissioner’s Office is also probing how the papers came to be in a set of desk drawers bought by a member of the public in second-hand furniture shop in Co Down.
The South Eastern Trust has also launched an investigation into the data breach.
Contained in the documents were the personal details of the executive team at the Belfast Health and Social Care Trust, including the phone numbers of senior managers.
The Belfast Telegraph returned the documents to the trust on Tuesday so it could start an investigation into how the documents came to be abandoned in a Lisburn shop.
Embarrassingly for the trust, among the files was an information risk assessment looking at how sensitive data can be better protected.
The document stated: “The guardianship and management of information in all its aspects (integrity, availability and confidentiality) is essential for the trust”.
This report added that during 2012/13, 17 incidents were reported to the Information Commissioner for consideration.
These included information sent to the wrong individual, issues with the security of records, loss of data, inappropriate access to information and transportation of records. The document added that the Information Commissioner had undertaken an audit of how the trust manages personal data.
It said that “provides us with a reasonable assurance level that processes and procedures are in place for delivering data protection compliance”.
Among the information contained in the files was a financial breakdown of the annual budget for social care and policy recommendations on an increase in the minimum wage for staff working in the community.
Private personnel records, including expenses claims, and handwritten minutes of meetings were also in the bundle.
The personal details of six candidates who had applied for a job in the trust, including their home addresses, employment and education record, phone numbers, email addresses and personal references, were contained in a folder abandoned in the set of office drawers.
The majority of documents appear to be dated from around 2015/16, although some date back to 2012.
It is thought that an employee who left the trust at some point around the end of 2016/17 may have left the documents in a drawer, with the furniture later donated to charity.
One of the documents contained a confidential budget breakdown of the cost of providing domiciliary care to older people and those with mental health and learning disabilities.
The Belfast Health and Social Care Trust was previously fined £225,000 after records were found abandoned in the disused Belvoir Park Hospital, which closed in 2006.
The Information Commissioner received new powers in 2010 allowing it to impose fines on public bodies that fail to secure personal data.
Responding to the data breach, the Belfast and South Eastern Trusts said: “Thank you for bringing this matter to our attention. The trust takes the handling of personal sensitive data very seriously.
“In order to further investigate and report the breach to the Information Commissioner’s Office, we would require a copy of the documents to evaluate where the data has come from.
“The trust would wish to undertake a thorough internal investigation and report same in line with the health and social care incident management process.”
The Information Commissioner’s Office said: “We’ve been made aware of a potential incident and will assess any further details.”