NHS trust ends appeal over record ICO fine and pays up

The NHS trust that was hit with the largest fine so far imposed by the Information Commissioner’s Office for data breaches has ended its appeal and paid up, it has emerged.

Brighton and Sussex University Hospitals Trust (BSUH) had initially vowed to fight the ICO’s £325,000 fine, which was levied after hard drives containing patient data were sold on an internet auction site. 

The trust’s decision to pay meant that a discount applied, bringing the amount of the penalty down to £260,000.

In a statement, BSUH’s interim chief executive Chris Adcock said: “We have made repeated attempts over the past six months.... to reach a settlement that recognised that errors were made but no harm arose, all of which have been rejected by the Information Commissioner’s Office.

“The fine is a staggering amount of money given that there was no loss of data, we informed the ICO at the time, co-operated throughout with them, the police and Crown Prosecution Service and recovered everything.”

Adcock added: “There is, however, nothing more odious than one public body having a public argument with another at the taxpayer’s expense. We are not prepared to incur further costs and are therefore paying the ICO £260,000.”

Local Government Lawyer understands that another case where an NHS trust is appealing the imposition of a monetary penalty by the ICO is still continuing.

Central London Community Healthcare NHS Trust said in May that it had instructed lawyers to challenge the £90,000 fine imposed after data from a palliative care unit was faxed on a number of occasions to the wrong recipient.

The case will be the first legal challenge to a monetary penalty issued by the ICO under s. 55A of the Data Protection Act 1988.

Philip Hoult