Manx Care fined £170,500 for infringing data protection laws

Manx Care has been fined £170,500 by the Island's Information Commissioner for infringing data protection laws.

In October 2021, Manx Care emailed an insecure attachment containing one patient’s confidential health data to more than 1,870 recipients. 

Manx Care was subject to an Enforcement Notice at that time and a further Enforcement Notice was issued in February 2022.  

The board failed to comply with those Enforcement Notices which has led to the penalty notice.

In a statement released earlier this week, the Information Commissioner said it's 'unacceptable for such a significant personal data breach to occur.'

However, the Commissioner has decided, in this case, to stay payment of the penalty until 31 December 2022. 

It will be dependent on Manx Care demonstrating it has implemented appropriate technical and organisational measures by the end of this year.

Failure to do so will mean that the penalty will become payable. 

You can read the Information Commissioner's full statement here.

 In response, Manx Care says "We acknowledge the significant failures outlined in the Enforcement Notice, which make for uncomfortable reading, and would like to offer our sincere and unreserved apologies to those individuals whose data was breached through no fault of their own.

Regardless of the fact that this was neither malicious nor intentional, this will undoubtedly have caused distress to them, for which we are incredibly sorry. Quite simply, this should not have happened. We would like to assure members of the public that steps are being taken to bring Manx Care’s standards of compliance into line with those expected of the organisation. These are historical breaches, and it is important to note that all patients whose data was inadvertently disclosed were notified at the time, and an apology provided."