5 ms·

If they have permission of government officials then what? We can hold companies accountable but how do you hold government accountable? In a meaningful way? C

If they have permission of government officials then what? We can hold companies accountable but how do you hold government accountable? In a meaningful way? Certainly we can find a myriad of excuses not to fire an government worker for a mistake I am fine with doing the same for this as well. The key is to learn from it and put into place processes that stop it from reoccurring. We need to weigh the penalties to the harm caused. Frankly, if no one lost their life or livelihood I don't think seeking the outcome you suggest is warranted.

sentenza 13y ago
It all depends on the value we assign to privacy. My personal opinion is that the handling of patient data should legally be protected somewhere on a scale between banking data and state secrets. If those kinds of data are mishandled, there _is_ punishment, no matter where you work. But then I'm culturally biased (we here in Germany seem to be collectively more paranoid about privacy than most other populations).
Silhouette 13y ago
Frankly, if no one lost their life or livelihood I don't think seeking the outcome you suggest is warranted. I could not disagree more strongly. A betrayal of public trust on this scale, abusing privileged access to the most sensitive and private of personal data, should be met by severe penalties. At a minimum the people who actually disclosed the data and the responsible executives at both the original NHS-related source and at PA Consulting should be facing jail time, and the executives barred from holding public office or directing companies for a very long time. That the company in question should be legally obliterated and that Google should be formally notified and required to completely delete the personal data they are illegally holding should go without saying. If Google refuse to comply then any Google executive who sets foot on European soil should be jailed as well.
pbhjpbhj 13y ago
>If they have permission of government officials then what? // They wouldn't - without wilful negligence - accept such "permission" from anyone other than a senior official who had in depth knowledge of the necessary requirements of privacy laws. A person in that permission is unlikely to be acting lawfully and is likely to be aware of that - there's no way they should retain a post with responsibility over anything greater than a stapler after that.
- Silhouette 13y ago
  To be fair, there are a few grey areas in the law as it currently stands in the UK that might be relevant if we're arguing about government permission. The main one is probably s251 NHS Act 2006, which grants the Secretary of State for Health certain powers to set aside the default confidentiality rules for specific medical purposes. I'm investigating whether those powers are a relevant factor in this case, but so far I've found no verifiable information either way.
  - pbhjpbhj 13y ago
    >The main one is probably s251 NHS Act 2006, which grants the Secretary of State for Health certain powers to set aside the default confidentiality rules for specific medical purposes. // Most laws seem to have these SoS exclusion clauses. In this particular case, S.251(1)¹ says "The Secretary of State may by regulations make such provision for and in connection with requiring or regulating the processing of prescribed patient information for medical purposes as he considers necessary or expedient— So it's by regulations², ie "rules". Whilst they don't need a new law to be passed they're still a statutory instrument, it's not like this section allows the SoS to just decide by himself. See for example S.252(2); and S.251(7), quoted here: "Regulations under this section may not make provision for or in connection with the processing of prescribed patient information in a manner inconsistent with any provision made by or under the Data Protection Act 1998 (c 29)." --- 1 - http://www.legislation.gov.uk/ukpga/2006/41/part/13/crossheading/patient-information http://www.legislation.gov.uk/ukpga/2006/41/part/13/crosshea... 2 - http://www.legislation.gov.uk/uksi/2002/1438/pdfs/uksi_20021438_en.pdf http://www.legislation.gov.uk/uksi/2002/1438/pdfs/uksi_20021..., http://www.hra.nhs.uk/documents/2014/02/cag-frequently-asked-questions-1.pdf http://www.hra.nhs.uk/documents/2014/02/cag-frequently-asked...

sentenza 13y ago

It all depends on the value we assign to privacy. My personal opinion is that the handling of patient data should legally be protected somewhere on a scale between banking data and state secrets. If those kinds of data are mishandled, there _is_ punishment, no matter where you work. But then I'm culturally biased (we here in Germany seem to be collectively more paranoid about privacy than most other populations).

Silhouette 13y ago

Frankly, if no one lost their life or livelihood I don't think seeking the outcome you suggest is warranted. I could not disagree more strongly. A betrayal of public trust on this scale, abusing privileged access to the most sensitive and private of personal data, should be met by severe penalties. At a minimum the people who actually disclosed the data and the responsible executives at both the original NHS-related source and at PA Consulting should be facing jail time, and the executives barred from holding public office or directing companies for a very long time. That the company in question should be legally obliterated and that Google should be formally notified and required to completely delete the personal data they are illegally holding should go without saying. If Google refuse to comply then any Google executive who sets foot on European soil should be jailed as well.

pbhjpbhj 13y ago

>If they have permission of government officials then what? // They wouldn't - without wilful negligence - accept such "permission" from anyone other than a senior official who had in depth knowledge of the necessary requirements of privacy laws. A person in that permission is unlikely to be acting lawfully and is likely to be aware of that - there's no way they should retain a post with responsibility over anything greater than a stapler after that.

Silhouette 13y ago
To be fair, there are a few grey areas in the law as it currently stands in the UK that might be relevant if we're arguing about government permission. The main one is probably s251 NHS Act 2006, which grants the Secretary of State for Health certain powers to set aside the default confidentiality rules for specific medical purposes. I'm investigating whether those powers are a relevant factor in this case, but so far I've found no verifiable information either way.
- pbhjpbhj 13y ago
  >The main one is probably s251 NHS Act 2006, which grants the Secretary of State for Health certain powers to set aside the default confidentiality rules for specific medical purposes. // Most laws seem to have these SoS exclusion clauses. In this particular case, S.251(1)¹ says "The Secretary of State may by regulations make such provision for and in connection with requiring or regulating the processing of prescribed patient information for medical purposes as he considers necessary or expedient— So it's by regulations², ie "rules". Whilst they don't need a new law to be passed they're still a statutory instrument, it's not like this section allows the SoS to just decide by himself. See for example S.252(2); and S.251(7), quoted here: "Regulations under this section may not make provision for or in connection with the processing of prescribed patient information in a manner inconsistent with any provision made by or under the Data Protection Act 1998 (c 29)." --- 1 - http://www.legislation.gov.uk/ukpga/2006/41/part/13/crossheading/patient-information http://www.legislation.gov.uk/ukpga/2006/41/part/13/crosshea... 2 - http://www.legislation.gov.uk/uksi/2002/1438/pdfs/uksi_20021438_en.pdf http://www.legislation.gov.uk/uksi/2002/1438/pdfs/uksi_20021..., http://www.hra.nhs.uk/documents/2014/02/cag-frequently-asked-questions-1.pdf http://www.hra.nhs.uk/documents/2014/02/cag-frequently-asked...