Rise in health sector data breach complaints

Thursday 30 May 2019

Data protection complaints against the health sector saw a “notable” rise last year – but the finance sector is still the biggest alleged offender when it comes to information handling.

The statistics came in Information Commissioner Dr Jay Fedorak’s first annual report, which showed that data protection complaints rose by 235% overall in 2018 – the year in which the new GDPR legislation came into force.

Last year, the Data Protection Authority dealt with 184 cases, the majority of which (49) involved the island’s largest employer, the finance industry. Of 141 self-reported breaches, all but 20 came following the introduction of the new law at the end of May.

Pictured: Dr Jay Fedorak's annual report noted that most reported data protection complaints related to the finance sector.

Reporting a tripling in workload and an increase in States funding of £368,931 – largely to prepare for the new law – the Authority is making its first report to the States as an independent entity as required by the EU Data Protection Directive. Previously, the Information Commissioner’s office was a non-ministerial department of the States.

Commenting on a huge increase in data protection complaints last year, Dr Fedorak draws attention to the ‘noteworthy’ volume of complaints against financial institutions which constitute 49 of the 184 total, well ahead of public authorities, the next largest sector at 33 cases.  

“As expected, Jersey’s biggest business sectors received the most complaints, but there has been a notable increase in the number of complaints (13) involving the health sector,” he adds.

Pictured: Information Commissioner Dr Jay Fedorak.

Although the Data Protection Authority managed to resolve all cases without the need for any formal enforcement action, it did issue one information notice, a formal mechanism to compel the release of information required for an ongoing investigation, details of which are not yet public.

While the Authority says that it tries to work towards what it describes as “mutually satisfactory resolution”, Dr Fedorak notes that this has not always been possible as a result of the increase in cases involving complex interlinked issues regarding employment grievances or legal proceedings in a family or civil court.