BBC News recently highlighted a stark example of a failure to
protect sensitive data. The DVLA sent a letter about a driving
license to "multiple sclerosis Caron Garrod."
Mrs Garrod was justifiably offended by the insensitive title and
horrified that her medical condition had been divulged through the
postal system.
The DVLA has apologised and promised an urgent inquiry. Our
amateur sleuths wonder if someone used auto-replace to change MS to
multiple sclerosis – but the unintended consequence was that
Ms Garrod became multiple sclerosis Garrod.
Something had obviously gone awry at the DVLA and the disclosure
was clearly unintentional. However, a simple administrative error
like this can have grave ramifications. Under the Data Protection
Act 1988, medical information is classed as "sensitive
personal data." Organisations that hold such data have a duty
to protect it. There are strict rules under the DPA about its
processing and security. Those rules will become
