Civil servants caught looking at private files in personal data breaches

Almost 1,000 DWP staff were disciplined in a 10-month period for unlawfully or inappropriately accessing social security records, according to figures released under the Freedom of Information laws.

Meanwhile, over the past year there were at least 13 cases per month of unlawful access to medical records reported to the Department of Health (DoH).

The figures were obtained by the Channel 4's Dispatches programme as part wider year-long investigation into private detectives accused of selling access to private information including health, benefit and criminal records and mobile phone bill and bank accounts.

The DWP figures show that between April 2010 and March last year a total of 513 staff members were disciplined for "unauthorised disclosure of official, sensitive, private and/or personal information ... to anyone" from its database.

The database holds the records of 98 million people, which can be accessed by 200,000 people. For the 10 months from April 2011 to this January, the figure was 463, the figures showed.

Taking into account all types of data offence, ranging from breaches of the Data Protection Act to inappropriate browsing of personal records of benefits claimants, nearly 1,200 civil servants were disciplined between April 2010 and last March.

A further 992 were reprimanded between April 2011 and January this year, which is the equivalent of 4.57 cases per working day.

The DoH told the programme that it did not collect details of all cases of unlawful access of medical records but admitted there had been 158 incidents throughout last year, which was the equivalent of 13 per month.

In 2007, the figure was 28.

On Monday, producers of the programme, titled "Watching the Detectives", briefed the Home Affairs Committee as part of its inquiry on private investigators.

Keith Vaz, the committee's chairman said the documentary raised "very troubling questions about the illegal trade in personal data which is carried out by unscrupulous private investigators".

"The Committee heard ... that despite the majority of private investigators being hard working, professional and law abiding, there are some who are willing to flagrantly abuse the privacy of individuals," he said.

A spokesman for the Equality and Human Rights Commission said: "We are very worried about the ease with which private data can be obtained by murky means.

"If it was not for human rights law, which protects people's right to privacy, such practices would be more widespread."

"We want to work with the government to make personal information better protected by the law. Legislation needs to be streamlined so that it is easier for organisations to understand their responsibilities and simpler for citizens to know and use their rights."

A spokesman for the DwP, which employs about 100,000 people, said that officials “would not hesitate” to act if any staff had accessed information through inappropriate methods and had improved staff awareness of data protection.

The DoH said it provided “clear guidelines on patient confidentiality and effective information security” and officials took data protection “extremely seriously”.

"Individual NHS organisations are responsible for ensuring that their staff know what is expected of them in regard to respecting the confidentiality of their patients," a spokesman said.

“Medical records are private and any abuse of their confidentiality is deplorable. Individuals have a right to know that their personal information is protected.

"The NHS takes protecting individual privacy extremely seriously and if any member of staff is discovered intentionally breaching this, they will be subject to appropriate disciplinary action.”