8 ms·

Surely PA Consulting should immediately be sued out of existence. This kind of behaviour must be considered beyond negligent, practically criminal. I would str

by swombat 13y ago

Surely PA Consulting should immediately be sued out of existence. This kind of behaviour must be considered beyond negligent, practically criminal. I would strongly support throwing anyone involved in this into jail for a long time as a deterrent against future criminals. This is just unbelievable.

stuaxo 13y ago
I would strongly encourage everybody to contact the Information Commisioners Office, as this must be a breach of data protection ? https://ico.org.uk/Global/contact_us https://ico.org.uk/Global/contact_us If anybody has details about how this may be a breach of the data protection act exactly, then please post below.
- Raffers 13y ago
  It's one of the main points of the DPA - Not transferred outside the UK without adequate protection https://www.gov.uk/data-protection/the-data-protection-act https://www.gov.uk/data-protection/the-data-protection-act Although that is more speculation than anything, as we don't have any knowledge if the information was encrypted or not, or any other safe guards in place. But the fact it took them nearly 2 weeks to upload 129.6GB or 229.5GB (Article states DVD's nothing else) I wouldn't be surprised if there were none in place.
lotsofmangos 13y ago
Given it is now run by the ex head of Barclays Bank and is the second largest recipient of government contracts in the UK, I wouldn't hold your breath.
touristtam 13y ago
Surely the people in power should have paid more attention to this before handing the data to a private third party. Those who ignored the problem before it emerged should not be allowed near position of decision for public office. Rant apart, this seriously raise the question of do we not need to have an alternative (maybe a pan European subsidized, not for profit organization) to Skynet (sorry I meant Google)?
- icebraining 13y ago
  Rant apart, this seriously raise the question of do we not need to have an alternative (maybe a pan European subsidized, not for profit organization) to Skynet (sorry I meant Google)? The UK already has a program for accrediting and validating cloud providers (called G-Cloud[1]), that classifies services according to their suitability for storing confidential information, and of which Google is already excluded. If this company used Google anyway, what makes you think they wouldn't have even if there was such organization in place? [1] http://en.wikipedia.org/wiki/UK_Government_G-Cloud http://en.wikipedia.org/wiki/UK_Government_G-Cloud
ZoFreX 13y ago
According to them, they got approval for doing that: > The alternative was to upload it to the cloud using tools such as Google Storage and use BigQuery to extract data from it. As PA has an existing relationship with Google, we pursued this route (with appropriate approval). This showed that it is possible to get even sensitive data in the cloud and apply proper safeguards.
- deleted 13y ago
  [deleted]
  - icebraining 13y ago
    They didn't say they had approval from Google. That wouldn't make much sense, you don't really need approval from Google to use BigQuery, you just need to open a Google account and create a new BigQuery project on their Developers Console
    - tszming 13y ago
      Given that the scale of the data, it is likely that they need to contact Google to get rid of the default quotas: https://developers.google.com/bigquery/quota-policy https://developers.google.com/bigquery/quota-policy
      - icebraining 13y ago
        Why? I don't see any limit being hit by loading 27 DVDs worth of data.
- atmosx 13y ago
  So apparently they don't have money to spend on building a secure, state-owned cloud storage service for patient records right? I wonder, does the GCHQ use private cloud storage contractors or for spying material the government found money to create an appropriate database? :-)
  - 13y ago
Shivetya 13y ago
If they have permission of government officials then what? We can hold companies accountable but how do you hold government accountable? In a meaningful way? Certainly we can find a myriad of excuses not to fire an government worker for a mistake I am fine with doing the same for this as well. The key is to learn from it and put into place processes that stop it from reoccurring. We need to weigh the penalties to the harm caused. Frankly, if no one lost their life or livelihood I don't think seeking the outcome you suggest is warranted.
- sentenza 13y ago
  It all depends on the value we assign to privacy. My personal opinion is that the handling of patient data should legally be protected somewhere on a scale between banking data and state secrets. If those kinds of data are mishandled, there _is_ punishment, no matter where you work. But then I'm culturally biased (we here in Germany seem to be collectively more paranoid about privacy than most other populations).
- Silhouette 13y ago
  Frankly, if no one lost their life or livelihood I don't think seeking the outcome you suggest is warranted. I could not disagree more strongly. A betrayal of public trust on this scale, abusing privileged access to the most sensitive and private of personal data, should be met by severe penalties. At a minimum the people who actually disclosed the data and the responsible executives at both the original NHS-related source and at PA Consulting should be facing jail time, and the executives barred from holding public office or directing companies for a very long time. That the company in question should be legally obliterated and that Google should be formally notified and required to completely delete the personal data they are illegally holding should go without saying. If Google refuse to comply then any Google executive who sets foot on European soil should be jailed as well.
- pbhjpbhj 13y ago
  >If they have permission of government officials then what? // They wouldn't - without wilful negligence - accept such "permission" from anyone other than a senior official who had in depth knowledge of the necessary requirements of privacy laws. A person in that permission is unlikely to be acting lawfully and is likely to be aware of that - there's no way they should retain a post with responsibility over anything greater than a stapler after that.
yapcguy 13y ago
PA Consulting are idiots and everybody who gave them this contract should be fired. Saying "I didn't know" is no excuse as this is not the first time PA Consulting have lost data! "The Home Secretary announced on 10 September that the government has terminated its contract with PA Consulting, following the recent high profile data loss On 19 August PA Consulting formally notified the Home Office of the loss of a data stick containing sensitive information relating to the JTrack system which PA manage under contract to the Home Office The data on JTrack relates to prisoners and other offenders in England and Wales." http://www.scl.org/site.aspx?i=ne9297 http://www.scl.org/site.aspx?i=ne9297
DanBC 13y ago
It's hard to know from the article just what happened and what data was uploaded. But, even though they got approval, they may have committed a criminal offence. This data initiative is really important. They've got to do something to win back trust. Someone has to lose a job and someone has to go to jail (if a crime was committed).
- deleted 13y ago
  [deleted]
ataggart 13y ago
Taking a sentient human being and throwing them in a cage is a profoundly violent act. I find it troubling that you guys so casually reach for it as a punitive tool, particularly when the subject has neither committed physical violence nor poses such a threat to others. Surely you clever people can think of forms of punishment/deterrence less destructive to both the individual and society as a whole.
- Silhouette 13y ago
  Taking a sentient human being and throwing them in a cage is a profoundly violent act. I find it troubling that you guys so casually reach for it as a punitive tool We aren't reaching for it casually. Some of us consider privacy a fundamental value that must be defended, and regard an attack on our privacy with the same seriousness that we would regard an attack on our physical person. Which is more of a danger to me, someone who punches me in the face on their drunk night out and gives me a bloody lip and a bit of pain for a few hours, or someone who betrays confidences that may have lifelong implications for my employability, insurance premiums and credit levels, ability to travel freely, and for that matter my self-respect and basic human dignity, before you even get to the kinds of more extreme and very physical dangers that could be posed by invasions of privacy if we consider the lessons of history?
  - ataggart 13y ago
    >Some of us consider privacy a fundamental value that must be defended The severity of a punishment can be tuned separately from the form of punishment. Imprisonment is not appropriate merely by dint of your emotional reaction to the crime itself. >Which is more of a danger to me... Sufficient to warrant throwing them in a cage, being brutalized by actually violent criminals, imposing a direct cost burden on society, and also indirectly by depriving society of that individual's productivity? Probably neither.
    - pasbesoin 13y ago
      Financial penalties have a long record of poor influence toward desired, legal behaviour. Further, they tend to simply be, sooner or later, passed on to the customers or clients who in many cases are the original wronged. Those individuals actually responsible for the sanctioned behaviour are not or only weakly punished and perhaps influenced against its repetition. As an individual, one could well go to prison for such misbehaviour. Corporate and government employment should not serve as an impenetrable shield and dilution of responsibility against such eventuality. Incarceration is often described as having two goals: Punishment for crimes committed, and mitigation against such crimes. For the latter, both by actual restraint and by aversion to the potential results. It seems that stronger aversion is needed; we have a systemic problem with recurrence -- often by the same parties -- of this behaviour.
mcintyre1994 13y ago
PA Consulting definitely think they were in the right here, they attended a recruitment event at my university and told us about how they did this for the NHS using Google tools. I figured they had permission from the NHS or whatever, and they also seemed to have some relationship with Google. My first thought is that this is just an MP looking for attention, but if the NHS genuinely didn't know then I agree it's surely criminal.
crb 13y ago
PA Consulting's statement: PA purchased the commercially available Hospital Episode Statistics data set from the NHS Information Centre (now the Health and Social Care Information Centre). The data set does not contain information linked to specific individuals. The information is held securely in the cloud in accordance with conditions specified and approved by HSCIC. This new approach to analytics can help the NHS improve patient care. We have been able to identify where services are needed most and to understand previously unseen side effects of drugs and treatments. Our approach protects patient confidentiality and allows insights to be derived at significantly lower cost, and a hundred times faster, than any traditional approach. HSCIC's statement: The NHS Information Centre (NHS IC) signed an agreement to share pseudonymised Hospital Episodes Statistics data with PA Consulting in November 2011. This included Hospital Episode Statistics on Admitted Patient Care (1999/00 to Provisional 2011/12), Outpatient (2003/4 to Provisional 2011/12) and A&E (2007/8 to Provisional 2011/12). This agreement lasted to November 2012 and was amended in December 2012 to extend to November 2015. The agreement obliged PA Consulting to abide by conditions to protect the confidentiality of the data, including restricting the data to a named list of individuals, a prohibition on sharing any information with risk of identifying individuals and a requirement to destroy the data after the agreement end date. PA Consulting used a product called Google BigQuery to manipulate the datasets provided and the NHS IC was aware of this. The NHS IC had written confirmation from PA Consulting prior to the agreement being signed that no Google staff would be able to access the data; access continued to be restricted to the individuals named in the data sharing agreement. http://www.paconsulting.com/introducing-pas-media-site/releases/pa-consulting-group-statement-3-march-2014/ http://www.paconsulting.com/introducing-pas-media-site/relea... http://www.hscic.gov.uk/article/3948/Statement-Use-of-data-by-PA-consulting http://www.hscic.gov.uk/article/3948/Statement-Use-of-data-b...
- Timmmmbob 13y ago
  > no Google staff would be able to access the data Well that's obviously bullshit... But aside from that, if it's commercially available and pseudonymised, I can't see much wrong with it.
  - sgt101 13y ago
higherpurpose 13y ago
And Obama seriously considers letting 3rd parties keeping everyone's private data? No Mr. Obama, neither NSA keeping the data nor 3rd parties is the solution. The solution is to stop spying on everyone.
- thrownaway2424 13y ago
  Who do you think is holding your health records right now?
dhoulb 13y ago
Rarr, scary database, rarrr.

by swombat 13y ago

stuaxo 13y ago

I would strongly encourage everybody to contact the Information Commisioners Office, as this must be a breach of data protection ? https://ico.org.uk/Global/contact_us https://ico.org.uk/Global/contact_us If anybody has details about how this may be a breach of the data protection act exactly, then please post below.

Raffers 13y ago
It's one of the main points of the DPA - Not transferred outside the UK without adequate protection https://www.gov.uk/data-protection/the-data-protection-act https://www.gov.uk/data-protection/the-data-protection-act Although that is more speculation than anything, as we don't have any knowledge if the information was encrypted or not, or any other safe guards in place. But the fact it took them nearly 2 weeks to upload 129.6GB or 229.5GB (Article states DVD's nothing else) I wouldn't be surprised if there were none in place.

lotsofmangos 13y ago

Given it is now run by the ex head of Barclays Bank and is the second largest recipient of government contracts in the UK, I wouldn't hold your breath.

touristtam 13y ago

Surely the people in power should have paid more attention to this before handing the data to a private third party. Those who ignored the problem before it emerged should not be allowed near position of decision for public office. Rant apart, this seriously raise the question of do we not need to have an alternative (maybe a pan European subsidized, not for profit organization) to Skynet (sorry I meant Google)?

icebraining 13y ago
Rant apart, this seriously raise the question of do we not need to have an alternative (maybe a pan European subsidized, not for profit organization) to Skynet (sorry I meant Google)? The UK already has a program for accrediting and validating cloud providers (called G-Cloud[1]), that classifies services according to their suitability for storing confidential information, and of which Google is already excluded. If this company used Google anyway, what makes you think they wouldn't have even if there was such organization in place? [1] http://en.wikipedia.org/wiki/UK_Government_G-Cloud http://en.wikipedia.org/wiki/UK_Government_G-Cloud

ZoFreX 13y ago

According to them, they got approval for doing that: > The alternative was to upload it to the cloud using tools such as Google Storage and use BigQuery to extract data from it. As PA has an existing relationship with Google, we pursued this route (with appropriate approval). This showed that it is possible to get even sensitive data in the cloud and apply proper safeguards.

deleted 13y ago
[deleted]
- icebraining 13y ago
  They didn't say they had approval from Google. That wouldn't make much sense, you don't really need approval from Google to use BigQuery, you just need to open a Google account and create a new BigQuery project on their Developers Console
  - tszming 13y ago
    Given that the scale of the data, it is likely that they need to contact Google to get rid of the default quotas: https://developers.google.com/bigquery/quota-policy https://developers.google.com/bigquery/quota-policy
    - icebraining 13y ago
      Why? I don't see any limit being hit by loading 27 DVDs worth of data.
atmosx 13y ago
So apparently they don't have money to spend on building a secure, state-owned cloud storage service for patient records right? I wonder, does the GCHQ use private cloud storage contractors or for spying material the government found money to create an appropriate database? :-)
- 13y ago

Shivetya 13y ago

If they have permission of government officials then what? We can hold companies accountable but how do you hold government accountable? In a meaningful way? Certainly we can find a myriad of excuses not to fire an government worker for a mistake I am fine with doing the same for this as well. The key is to learn from it and put into place processes that stop it from reoccurring. We need to weigh the penalties to the harm caused. Frankly, if no one lost their life or livelihood I don't think seeking the outcome you suggest is warranted.

sentenza 13y ago
It all depends on the value we assign to privacy. My personal opinion is that the handling of patient data should legally be protected somewhere on a scale between banking data and state secrets. If those kinds of data are mishandled, there _is_ punishment, no matter where you work. But then I'm culturally biased (we here in Germany seem to be collectively more paranoid about privacy than most other populations).
Silhouette 13y ago
Frankly, if no one lost their life or livelihood I don't think seeking the outcome you suggest is warranted. I could not disagree more strongly. A betrayal of public trust on this scale, abusing privileged access to the most sensitive and private of personal data, should be met by severe penalties. At a minimum the people who actually disclosed the data and the responsible executives at both the original NHS-related source and at PA Consulting should be facing jail time, and the executives barred from holding public office or directing companies for a very long time. That the company in question should be legally obliterated and that Google should be formally notified and required to completely delete the personal data they are illegally holding should go without saying. If Google refuse to comply then any Google executive who sets foot on European soil should be jailed as well.
pbhjpbhj 13y ago
>If they have permission of government officials then what? // They wouldn't - without wilful negligence - accept such "permission" from anyone other than a senior official who had in depth knowledge of the necessary requirements of privacy laws. A person in that permission is unlikely to be acting lawfully and is likely to be aware of that - there's no way they should retain a post with responsibility over anything greater than a stapler after that.

yapcguy 13y ago

PA Consulting are idiots and everybody who gave them this contract should be fired. Saying "I didn't know" is no excuse as this is not the first time PA Consulting have lost data! "The Home Secretary announced on 10 September that the government has terminated its contract with PA Consulting, following the recent high profile data loss On 19 August PA Consulting formally notified the Home Office of the loss of a data stick containing sensitive information relating to the JTrack system which PA manage under contract to the Home Office The data on JTrack relates to prisoners and other offenders in England and Wales." http://www.scl.org/site.aspx?i=ne9297 http://www.scl.org/site.aspx?i=ne9297

DanBC 13y ago

It's hard to know from the article just what happened and what data was uploaded. But, even though they got approval, they may have committed a criminal offence. This data initiative is really important. They've got to do something to win back trust. Someone has to lose a job and someone has to go to jail (if a crime was committed).

deleted 13y ago
[deleted]

ataggart 13y ago

Taking a sentient human being and throwing them in a cage is a profoundly violent act. I find it troubling that you guys so casually reach for it as a punitive tool, particularly when the subject has neither committed physical violence nor poses such a threat to others. Surely you clever people can think of forms of punishment/deterrence less destructive to both the individual and society as a whole.

Silhouette 13y ago
Taking a sentient human being and throwing them in a cage is a profoundly violent act. I find it troubling that you guys so casually reach for it as a punitive tool We aren't reaching for it casually. Some of us consider privacy a fundamental value that must be defended, and regard an attack on our privacy with the same seriousness that we would regard an attack on our physical person. Which is more of a danger to me, someone who punches me in the face on their drunk night out and gives me a bloody lip and a bit of pain for a few hours, or someone who betrays confidences that may have lifelong implications for my employability, insurance premiums and credit levels, ability to travel freely, and for that matter my self-respect and basic human dignity, before you even get to the kinds of more extreme and very physical dangers that could be posed by invasions of privacy if we consider the lessons of history?
- ataggart 13y ago
  >Some of us consider privacy a fundamental value that must be defended The severity of a punishment can be tuned separately from the form of punishment. Imprisonment is not appropriate merely by dint of your emotional reaction to the crime itself. >Which is more of a danger to me... Sufficient to warrant throwing them in a cage, being brutalized by actually violent criminals, imposing a direct cost burden on society, and also indirectly by depriving society of that individual's productivity? Probably neither.
  - pasbesoin 13y ago
    Financial penalties have a long record of poor influence toward desired, legal behaviour. Further, they tend to simply be, sooner or later, passed on to the customers or clients who in many cases are the original wronged. Those individuals actually responsible for the sanctioned behaviour are not or only weakly punished and perhaps influenced against its repetition. As an individual, one could well go to prison for such misbehaviour. Corporate and government employment should not serve as an impenetrable shield and dilution of responsibility against such eventuality. Incarceration is often described as having two goals: Punishment for crimes committed, and mitigation against such crimes. For the latter, both by actual restraint and by aversion to the potential results. It seems that stronger aversion is needed; we have a systemic problem with recurrence -- often by the same parties -- of this behaviour.

mcintyre1994 13y ago

PA Consulting definitely think they were in the right here, they attended a recruitment event at my university and told us about how they did this for the NHS using Google tools. I figured they had permission from the NHS or whatever, and they also seemed to have some relationship with Google. My first thought is that this is just an MP looking for attention, but if the NHS genuinely didn't know then I agree it's surely criminal.

crb 13y ago

PA Consulting's statement: PA purchased the commercially available Hospital Episode Statistics data set from the NHS Information Centre (now the Health and Social Care Information Centre). The data set does not contain information linked to specific individuals. The information is held securely in the cloud in accordance with conditions specified and approved by HSCIC. This new approach to analytics can help the NHS improve patient care. We have been able to identify where services are needed most and to understand previously unseen side effects of drugs and treatments. Our approach protects patient confidentiality and allows insights to be derived at significantly lower cost, and a hundred times faster, than any traditional approach. HSCIC's statement: The NHS Information Centre (NHS IC) signed an agreement to share pseudonymised Hospital Episodes Statistics data with PA Consulting in November 2011. This included Hospital Episode Statistics on Admitted Patient Care (1999/00 to Provisional 2011/12), Outpatient (2003/4 to Provisional 2011/12) and A&E (2007/8 to Provisional 2011/12). This agreement lasted to November 2012 and was amended in December 2012 to extend to November 2015. The agreement obliged PA Consulting to abide by conditions to protect the confidentiality of the data, including restricting the data to a named list of individuals, a prohibition on sharing any information with risk of identifying individuals and a requirement to destroy the data after the agreement end date. PA Consulting used a product called Google BigQuery to manipulate the datasets provided and the NHS IC was aware of this. The NHS IC had written confirmation from PA Consulting prior to the agreement being signed that no Google staff would be able to access the data; access continued to be restricted to the individuals named in the data sharing agreement. http://www.paconsulting.com/introducing-pas-media-site/releases/pa-consulting-group-statement-3-march-2014/ http://www.paconsulting.com/introducing-pas-media-site/relea... http://www.hscic.gov.uk/article/3948/Statement-Use-of-data-by-PA-consulting http://www.hscic.gov.uk/article/3948/Statement-Use-of-data-b...

Timmmmbob 13y ago
> no Google staff would be able to access the data Well that's obviously bullshit... But aside from that, if it's commercially available and pseudonymised, I can't see much wrong with it.
- sgt101 13y ago

higherpurpose 13y ago

And Obama seriously considers letting 3rd parties keeping everyone's private data? No Mr. Obama, neither NSA keeping the data nor 3rd parties is the solution. The solution is to stop spying on everyone.

thrownaway2424 13y ago
Who do you think is holding your health records right now?

dhoulb 13y ago

Rarr, scary database, rarrr.