Police, hospitals body slapped after data leaks

The police force and Hospital Authority have been served with enforcement notices by the privacy commissioner for breaching personal data laws.self storage He found that both failed to take steps to keep sensitive information safe from unauthorized or accidental access, loss or use. Between October 2011 and January this year, the personal data of 285 people, including crime victims, witnesses and suspects, was lost by police officers who mislaid notebooks and copies of fixed- penalty tickets. In one serious case, an officer lost 17 notebooks, containing the names, identity card numbers and addresses of 41 people, on a bus last October. The commissioner said the case shows there is no mechanism to verify the keeping of such notebooks by officers, and no rule requiring officers issuing notebooks to check on their use. In addition, a chief inspector failed to verify that the 17 notebooks were kept by the officer for at least five years. Privacy commissioner Allan Chiang Yam-wang said the police had ``failed to take all practicable steps, including putting in place a set of comprehensive procedures as well as ensuring the effective implementation of its supervision and monitoring system, to safeguard the security of police documents containing personal data.'' Overall, 迷利倉hiang said: ``The incidents involved negligence or carelessness on the part of the police officers concerned.'' He also urged the police to review the design of equipment and uniforms to enhance the protection of documents. There were two cases in which the police leaked internal documents containing personal data through Foxy, an internet file-sharing software. In one case, an officer had been downloading files to his personal computer with his own USB without approval since 2007. He did not completely erase the data when he sold the computer. The enforcement notice to the Hospital Authority involved two incidents of failing to securely destroy personal data affecting at least 16 patients. Hospital waste containing patients' data was found abandoned outside a factory in Fan Ling in June and September last year. Another featured shredded strips of medical appointment slips from Our Lady of Maryknoll Hospital which contained names, genders, ages and partial identity card numbers. Chiang said the authority's supervision of the company destroying such waste was inadequate. Police said they will conduct an investigation into each incident. The Hospital Authority said it has retrieved the data and promises to tighten security measures. beatrice.siu@singtaonewscorp.com 迷你倉