Data Protection

silkyuk9

You may find information here

www.connectingforhealth.nhs.uk/.../infogov/records/it05a-i.ppt

GrannyKate

Hi again
Looking at the posts which crossed with mine it appears that you are providing a support function to case workers and do not use the files yourself. In that case there is no justification for requiring you to take overnight responsibility for such sensitive data which you should not be in a position to read or copy (not suggesting you would but the employer is taking an unacceptable risk here)
if you job description requires you to transport files in your car then you definitely need business cover on your car insurance and I would expect you to be paid travel between your base and the other sites.
Not sure how long you have been there as do not want to risk losing your job but I am sure your employer is aware that Information Commissioner is currently levying massive fines on organisations which breach data protection and that child protection files are of particular concern. Does your Job Description specify that you must have a car to travel between sites (rare now as it can be a disability discrimination issue) and that you will personally transfer files?

ValHaller

GrannyKate wrote: »

I agree for the most part with ValHaller but do not think it would necessarily be unlawful to ask staff to carry files between sites as much of health and social care would not operate without this process.

Thanks for your input and your agreement. To clarify, my big doubts are about the overnight aspect of this. But the point really is to have the employer think this through and make the judgement about the lawfulness themselves

TimBear

There's not just the issue that they get stolen/in to the wrong hands (although that would be my prime concern). What if, heaven forbid, there was a fire or a flood and the documents were damaged? What's the back up system that your work has in place?

Sticky_Wicket

Thanks again folks, to answer some of your questions:

There is no back-up! If i lost or damaged the file then there would be no way of recovering the information.

My job description does not state I need a car for the role. I am office based so there is no need for one.

I have been in post for a few weeks under two years.

I have repeatedly advised that I am uncomfortable with the request but nothing is ever done about it and the requests to move files continue - but it is convenient for them.

My concern is that if i raise it as an issue, then they will somehow blame it on me and just hand me a data protection policy if one exists - and attempt to absolve themselves of any blame.

Ta muchly

Funky_Bold_Ribena

I would be asking 'does this follow the company procedure [written] for dealing with this data in this job'. If not, then follow the procedure. If there is no procedure, I would be noting down the steps I am being asked to follow, as a procedure, and emailing it to them asking for confirmation that this is the procedure they want you to follow, and not doing so until I have it in writing that they have specifically requested you to follow it.

GrannyKate

Doubt that employer will hand you a Data Protection Policy as that will certainly say that access to sensitive personal data should be restricted to those who need to see it and that data must be processed securely.

It seems to me that if you have an office based support role (possibly attending different sites on different days) then you should definitely not be responsible for the files overnight. As others have advised you need to tell employer in writing that the procedure which they have adopted is unsafe and that you believe that the Data Protection Act is being breached. If your managers are professionals (ie clinicians, teachers, social workers etc) they are also likely to be breaching their code of professional practice and the contract which they have to provide whatever service they are providing.
You could also approach this from the point of view of your car insurance and state that you have been advised it will be invalid if you use it for business purposes and it is only valid for journeys to and from work not for transporting files to be used by other persons.

Have you tried discussing this with the case workers who will no doubt be fully aware that your taking the files home is not acceptable.

agrinnall

And to add to GrannyKate's last point, are the case workers also aware that there is only one copy of these files? That seems a totally unacceptable risk for data of this type which may be impossible to recreate if destroyed, stolen or lost.

Sticky_Wicket

The case workers are perfectly aware as they have also adopted the practice of e-mailing me to transport the files, one even advised me that they thought it was 'custom and practice' within the organisation and therefore an accepted practice!

Sticky_Wicket

Just a thought - do i bring the breach of data protection to the managers in question who I express my concerns to but falls on deaf ears or the Board of directors?