NHS challenges £375,000 ICO fine after hard drive theft

An NHS Trust has announced its intention to fight a potential fine of £375,000 from the Information Commissioner's Office (ICO) after the theft of hard drives by a contractor.

Brighton and Sussex University Hospitals had asked a registered contractor to dispose of the hard drives, but they were instead sold on eBay, which led to an investigation by the ICO.

As a result, it gave notice to the Trust that a fine would be issued.

However, the Trust's chief executive Duncan Selbie said that, as the Trust was itself a victim of crime in the case, it would be challenging the fine, which, if upheld, would be the largest to date.

"As soon as we were alerted to this we informed the police and with their help we recovered all the hard drives stolen by this individual," said Selbie.

"We are confident that there is a very low risk of any of the data from them having passed into the public domain."

The ICO said it was unable to comment on the matter directly as the case was still on going.

"The ICO is currently making enquiries into a possible breach of the Data Protection Act and is unable to speculate on what action will be taken at this time," it said.

Data protection expert and partner at Field Fisher Waterhouse Stewart Room, told V3 the decision to challenge the ICO would be an interesting test case on the watchdog's right to fine organisations.

"[The] statement is very interesting, because it points to one of the most contentious issues within data protection regulatory action, namely the taking of strong action by the information commissioner when the data controller is itself a victim of crime," he said.

"If the Trust holds fast to its intention to challenge the Commissioner, it will have a large community of data controllers standing in its corner, due to widespread concern that the ICO's regulatory strategy in these circumstances is disproportionate."

To date, the ICO has fined nine organisations, with the highest fine standing at £130,000, which was issued to Powys County Council.