UK's National Health Service Plans To Use Big Data Analysis To Fight COVID-19 -- With The Help Of Palantir

from the history-has-its-eye-on-us dept

It's clear that digital technology will play a key role in helping to deal with the COVID-19 pandemic, whether as a way of disseminating information, telecommuting, or of keeping people entertained during lockdowns. Less welcome is the use of advanced surveillance and tracking techniques to monitor the movements of people to see if they are obeying quarantine restrictions. Another obvious way to apply technology is to manage the key resources being used to tackle it. That's what the UK's National Health Service (NHS) is doing:

The NHS is preparing to unveil a "data platform" which tracks the movement of critical staff and materials, giving ministers the first ever comprehensive view of the entire health system, Sky News can reveal.

Items tracked include the capacity of emergency departments; the number of calls to the NHS helpline; and the number and location of beds, ventilators and NHS staff. It is clearly crucially important to have a clear, real-time picture of all of these in order to manage this fast-moving disease as effectively as possible. The problem with this major new database and its associated dashboard is that the digital side of things is being handled by Palantir, which has become synonymous with high-tech government surveillance in both the US and further afield. Its move into analyzing health data is potentially concerning given the highly-personal nature of the information it will be handling. It is also likely to be the first of many such moves, rather than just a one-off. NHSX, the NHS "innovation unit" managing the project, is well-aware of Palantir's reputation and the worries its participation will engender. It is taking steps to head those off:

Despite the speed at which it has been forced to work, NHSX says it has taken full account of both data protection legislation and privacy concerns. The system removes identifiers such as names and addresses in order to keep the data as anonymous as possible. NHSX has also committed to closing the data agreements and removing or destroying the data once the pandemic abates.

Although sensitive personal health data is used to inform the dashboard, it is stored by Public Health England, and only provided to Palantir in an aggregated form

Palantir, too, knows that people will be worried by its move into healthcare. It has issued its own "Best practices for using data during a crisis", which concludes: "history has its eye on us".

We must not blindly accept the mantra of "desperate times call for desperate measures," but instead forge solutions that can survive a return to normalcy and not fundamentally alter our societal values. Any exceptional measures must be clearly justified by the facts and conditions of the moment but, also, in enacting them, build in mechanisms for rolling them back after the crisis and soberly evaluating the extent to which they were necessary and how we can do better next time. This is an emergency -- perhaps the defining one of our age. In acting decisively to defeat this pandemic, we must do so in a way that we will recognize ourselves when it's done.

Those are noble sentiments. Let's hope the reality matches them.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: covid-19, privacy, tracking, uk
Companies: palantir

Double Blow To The EU's Long-Delayed Unified Patent Court, But Supporters Unlikely To Give Up

from the increasingly-anachronistic dept

Remember the EU's unitary patent plan? No surprise if you don't -- attempts to create a unitary patent system across the region have been dragging on for decades. Back in 2012, Techdirt noted that the European Parliament had finally approved the plan to set up a new Unified Patent Court (UPC) for the EU, but it still hasn't come to fruition. Recently, the scheme has been dealt two major blows that are likely to delay it further, even if they don't kill it off entirely.

The first concerns the UK. It's one of the three nations that had to sign up to the UPC agreement for it to come into force. A big question was whether it could or would do so after brexit. The answer turns out to be "no". The second problem comes from Germany, where the country's constitutional court has ruled as follows:

The Act of Approval to the Agreement on a Unified Patent Court ("the Act of Approval") to confer sovereign powers on the Unified Patent Court is void. In its outcome, it amends the [German] Constitution in substantive terms, though it has not been approved by the Bundestag with the required two-thirds majority.

However, it's possible that can be solved by the Bundestag -- German's parliament -- holding another vote which does attain the two-thirds majority. There is likely to be pressure to do so because elsewhere the ruling by Germany's constitutional court (full translation from FFII.org) is helpful to supporters of the UPC, for reasons explained by The Register:

the German Constitutional Court effectively rejected the other arguments against the UPC's validity. In essence, they were: that because the UK is exiting the EU that the UPC is no longer valid because the UK was one of three compulsory signatories to it (the other two being France and Germany); and that the European Patent Office (EPO) is insufficiently independent because of "reforms" made by its former president Benoit Battistelli that concentrated power in his hands.

Importantly, the first point means the refusal of the UK to sign up is not regarded as an issue now that it has left the EU. As Florian Mueller writes on his blog: "there is widespread consensus that re-ratification (subsequently to renegotiation) is a question of when, not if." Although FFII.org agrees the patent industry will push hard to get the UPC implemented, it notes there are yet more bumps in that particular road:

the German Constitutional Court still have to decide soon over 4 other complaints, where complainants have raised the issue that the European Patent Office (EPO) cannot be brought to court for maladministration, in breach of the "rule of law" principle. If the court finds the EPO not in line with fundamental rights, this might have a bigger impact over the current system.

This point relates to the central role that will be played by the EPO in issuing the new unitary patents, valid across the EU. The EPO has long been a controversial institution: it is not part of the EU, its premises enjoy extraterritoriality, and its executives are granted diplomatic immunity that effectively places them outside the law. If allegations of maladministration cannot be brought to EU courts, that seems like a recipe for disaster. Irrespective of those particular questions, The Register article raises a more fundamental one: is it really worth bothering with a plan that was born decades ago? Both the unitary patent and UPC reflect a very different world from the one we now inhabit, which no longer regards more powerful patents as an obvious blessing.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: brexit, epo, eu, germany, patents, uk, unified patent court

Local Government Employee Fined For Illegally Deleting Item Requested Under Freedom Of Information Act

from the it-may-be-small,-but-it's-still-a-win dept

Techdirt writes about freedom of information matters often enough. Sadly, many of the stories are about governments and other official bodies refusing to comply with local Freedom of Information Act (FOIA) laws for various reasons, and using a variety of tricks. In other words, rights to FOI may exist in theory, but the practice falls woefully short. That makes the following story from the UK a welcome exception.

It concerns Nicola Young, a local government employee in the English market town of Whitchurch, in Shropshire. Part of her job as town clerk was to handle FOIA requests for the local council. One such request asked for a copy of the audio recording of a council meeting. Apparently the person requesting the file believed that the written minutes of the meeting had been fabricated, and wanted to check them against the recording. However, the reply came back that the file had already been deleted, as was required by the official council policy.

Undeterred, the person requesting the file sent a complaint to the UK's main Information Commissioner's Office (ICO), which carried out an investigation. The ICO discovered that the town clerk had not only claimed that the audio file had already been deleted when it actually existed, but that she personally deleted it a few days after the FOI request was made. Quite why is not clear, but as a result:

On Wednesday 11 March, Young, of Shrewsbury Street, Whitchurch, Shropshire, was convicted at Crewe Magistrates after pleading guilty to blocking records with the intention of preventing disclosure and was fined £400 [about $490], ordered to pay costs of £1,493 [$1,835] and a victim surcharge £40 [$50].

In its press release on the case, the ICO comments that it "marks the first ever successful conviction under the [UK's] FOIA.". It may be a small victory, but we'll take it.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: foia, nicola young, record destruction, uk

Clearview Is Handing Out Access To Dozens Of UK Entities, Setting Up Accounts For Congressional Reps

from the mass-marketing-privacy-violations dept

Clearview continues to make itself unpopular with the general public even as it increases its user base. Supposedly, it has worked with over 900 law enforcement agencies at this point, although it's unclear how many are actually using the software and how many have just been given trial logins.

Internal documents given to BuzzFeed show a number of federal agencies (FBI, ATF, Secret Service, CBP) have performed tens of thousands of searches of Clearview's scraped-together database. But it's not just law enforcement agencies that are using Clearview's facial recognition app. The documents showed a number of private companies have also at least test-driven the software, including Macy's, Walmart, Kohl's, and Albertsons.

The company continues to expand into other countries. The documents show Clearview has customers in 26 countries, including notorious human rights violators like Saudi Arabia and UAE.

Over in the UK, Clearview is being used by more public and private entities -- another strange assortment of users that makes up a small part of the 2,900 institutions the company has handed its software to.

The National Crime Agency and Metropolitan Police are among a number of leading organisations across the UK that have registered users with controversial facial recognition technology firm Clearview AI, according to documents reviewed by BuzzFeed News.

The technology also had users at a number of other police forces, private investment firms, the Ministry of Defence, and a charity founded by Harry Potter author J.K. Rowling, the data shows.

The Met Police already has its own facial recognition tech -- one that has consistently underperformed for years. According to a spokesperson, Clearview's proprietary database of 3 billion photos scraped from the web isn't being used in conjunction with the live tech already deployed by the agency. Other UK law enforcement agencies listed in the documents as having performed searches all stated they had used the software "on a trial basis" and are not currently using the tech to search for criminal suspects.

The same comments were made by some private financial firms, which claimed it was demoed for them by Clearview, but they weren't currently using the software. A few refused to provide any comment at all, leaving that question open.

The searches run by J.K. Rowling's charity also appear to have been part of a demo.

The charity told BuzzFeed News that a staff member had tried out the software once at an event and Clearview was not being used by Lumos in its work.

A spokesperson for Lumos said: “A member of Lumos staff attended an anti-trafficking event last year to which a number of NGOs were invited as well as a representative from Clearview AI.

“During the event the representative from Clearview AI demonstrated the software which we understand was being used in the US by law enforcement to tackle child exploitation.

Back in the United States, Clearview continues its aggressive expansion, preemptively creating accounts for Congressional reps and administration officials.

Clearview AI, the secretive facial recognition company whose software has been used by more than 2,200 organizations around the world, created accounts for the offices of four members of Congress, including one whom President Donald Trump is nominating for director of national intelligence.

Clearview data reviewed by BuzzFeed News includes an unused account for Texas Rep. John Ratcliffe, a Republican whose eventual nomination to DNI was announced by Trump on Friday via tweet. Trump has yet to formally send the nomination to the Senate.

In Clearview documents viewed by BuzzFeed News, the entry for “Congressman John Ratcliffe Staff” indicates that that user had performed zero log-ins and zero searches, meaning that Clearview had created an account that was never used. A spokesperson for Ratcliffe told BuzzFeed News that Clearview staff had met with Ratcliffe’s staff.

All of these appear to have been set up when staffers met with Clearview reps. Only one rep's office -- Mark Walker's -- appears to have run any searches.

In other news on the homefront, Apple has disabled Clearview's iOS app for violating the company's rules on distribution.

In distributing its app for Apple devices, Clearview, which BuzzFeed News reported earlier this week has been used by more than 2,200 public and private entities including Immigration and Customs Enforcement (ICE), the FBI, Macy’s, Walmart, and the NBA, has been sidestepping the Apple App Store, encouraging those who want to use the software to download its app through a program reserved exclusively for developers. In response to an inquiry from BuzzFeed News, Apple investigated and suspended the developer account associated with Clearview, effectively preventing the iOS app from operating.

The company's CEO says it's working with Apple to get the app reinstated, claiming Clearview did not actually violate the rules since the app cannot be used without "proper authorization." But that doesn't explain why Clearview is demoing its "internal use application" to hundreds of potential customers and facilitating that access by setting up accounts for anyone who wants to try the app out. Apple's Enterprise Developer program forbids the distribution of internal apps to users outside of the developer's company.

If Clearview stays ousted, it's going to hurt its plans for expansion. One of the selling points of Clearview's tech is that it's available in app form -- portable and usable by anyone who owns a smartphone. Linking the app to 3 billion face photos and other personal information scraped from the web makes it almost irresistible. Taking a sizable chunk of phone users out of the equation will slow the company's roll. But I imagine it will find a way to get some version of its app back into the store -- and into the hands of uncurated user base.  

Filed Under: facial recognition, uk
Companies: clearview, clearview ai

UK Ignores US, Won't Fully Ban Huawei Gear From Its Networks

from the watching-you-watching-me dept

We've repeatedly noted that while Huawei certainly engages in some clearly sketchy shit (like any good unaccountable telecom giant), the evidence supporting the global blacklist of the company has been lacking. The Trump administration still hasn't provided any public evidence supporting the central justification for the global blackballing effort (that Huawei works for China to spy wholesale on Americans), and at least some of the effort is little more than gamesmanship by companies like Cisco, which don't want to compete with cheaper Chinese gear as they hunt down network and 5G contracts.

Not everybody has been responsive to the US blackballing campaign. Germany has generally taken the stance that it's easier to just ban gear with clear security problems instead of stumbling down the messy blackballing rabbit hole, which requires immensely complicated enforcement action and ripping gear out of existing networks. And the UK this week announced that it would be bucking US demands and only ban Huawei gear from the most sensitive network areas. There are also a few other restrictions that fall well short of a full ban:

"There is also a limit in place on how much equipment networks can buy from one “high risk vendor” for a particular part of the infrastructure known as the Radio Access Network (RAN). This is essentially the part of the network that hooks up your devices with the actual 5G signal. So Huawei can participate in the RAN, but no more than 35% of a single vendor’s equipment in this part of the network can come from Huawei."

The US obsession with Huawei as a security threat certainly isn't baseless, but at the same time the Trump administration has rattled the saber on Huawei, it has done virtually nothing for other major aspects of cybersecurity, be it the abysmal lack of security in the internet of things (much of which originates in... gasp... China), or the terrifying lack of adequate election security to protect us from Chinese hackers. Either you're concerned about cybersecurity or you aren't, and our asymmetrical policies on this subject are usually fairly telling.

Again, companies like Cisco have spent years successfully scaring lawmakers into cracking down on Chinese network gearmakers whose cheaper (and admittedly often shitty) gear they simply don't want to compete with. Yet it's pretty rare to see that ever reflected in print. This week the Telegraph was one of a tiny number of outlets which quoted experts suggesting the Huawei threat might just be over-hyped:

"Dr Greg Austin, a cybersecurity expert at the International Institute for Strategic Studies, said that "the US case against Huawei always had more to do with exaggeration of the espionage gains to China from it than with any sober assessment...Other experts said there has still been no public evidence of Huawei using its technology for espionage and hoped that the Government decision will avoid any impact on the economy from network operators having to rip out large amounts of Huawei technology.

Though even here, you should note nobody wants to say why the threat is being over-hyped, or why, after a decade (and even one 18 month investigation) nobody has been able to prove Huawei spies on Americans. In general, skepticism on this subject has all been drowned out by a chorus that seems oblivious to the idea that this blackballing effort may not entirely be grounded in factual reality. None of this is to say Huawei (or China) are saints, just to say that patriotism tends to make a certain segment blind to the lobbying gamesmanship that's underpinning many of these "very sober national security determinations."

There's also the hypocrisy. The NSA literally broke into Huawei to implant backdoors in the company's gear, and routinely engages in the kind of behavior we lambaste China for. It's now impossible to determine where AT&T physically ends and the NSA begins, yet if foreign countries were to suddenly ban AT&T from doing business overseas, the immense hyperventilation and face-fanning from all of the exact same folks who support a blackballing of Huawei would register on the Richter scale. There's rarely room for nuance in the conversations about Huawei, which gives US lobbyists ample legroom to play.

Filed Under: networking gear, uk
Companies: huawei

UK Says It Won't Implement The EU Copyright Directive, Which Wouldn't Have Passed Without Its Support During A Crucial Vote

from the cunning-plan-or-just-can't-be-bothered? dept

As Techdirt has reported, the EU member states are starting to transpose the EU Copyright Directive into their national laws, and the results are as bad as we feared. France wants to implement the Article 17 upload filters without user protections, while Germany plans to place ludicrous restrictions on the use of press materials as part of its implementation of Article 15. What's particularly frustrating about the whole sorry EU Copyright Directive saga is that the law was very close to being thrown out last April. That was when the final vote by the EU Council (made up of representatives of the EU member states) took place. As Mike wrote at the time, because Sweden changed its original position, and voted against the Directive, it would only have required either Germany or the UK to do the same, and the legislation would have been dropped.

An interesting wrinkle to the story is that Boris Johnson, then still jockeying for leadership of the UK Conservative party, tweeted that the EU Copyright Directive would be "terrible for the Internet", and that the UK "should not apply it." That was easy to say when he had neither power nor responsibility. But now that Johnson has become UK prime minister, and enjoys a massive majority in the House of Commons, which effectively means he can do whatever he wants, will he take the same position? Rather amazingly, it seems he will.

A written question was submitted to the UK government: "To ask the Secretary of State for Business, Energy and Industrial Strategy, what plans the Government has to bring forward legislative proposals to implement the EU Copyright Directive in UK law." To which the UK government replied:

The deadline for implementing the EU Copyright Directive is 7 June 2021. The United Kingdom will leave the European Union on 31 January 2020 and the Implementation Period will end on 31 December 2020. The Government has committed not to extend the Implementation Period. Therefore, the United Kingdom will not be required to implement the Directive, and the Government has no plans to do so. Any future changes to the UK copyright framework will be considered as part of the usual domestic policy process.

That is, after providing one of the crucial votes of support that ensured the EU Copyright Directive would become law, the UK is not now going to implement it. A cynic might think that the UK has done this to gain an advantage over the rest of the EU as member states grapple with the serious harm the Copyright Directive will inflict on the region's Internet users and startups. In truth, it is probably more a reflection of the fact that the UK government will be so busy passing legislation to cope with the aftershocks of Brexit, it won't have time to deal with minor issues like copyright.

And for those who will be celebrating this news as a great win, it's worth noting the careful phrasing of the reply: "Any future changes to the UK copyright framework will be considered as part of the usual domestic policy process". Although the UK government won't implement an EU law -- not least for dogmatic reasons -- it hasn't ruled out bringing in its own 100% true-Brit law that does much the same. It's unlikely that the well-connected UK copyright industry is going sit quietly and watch EU rivals gain special privileges online without demanding the same. Expect lots of whining and cries of pain from the recording industry and publishers until the UK government eventually gets around to passing national legislation that is as bad -- or even worse -- than the EU's.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: brexit, copyright, copyright directive, eu, uk

Beer Trademarks At Record High In UK As The Locking Up Of Language Continues To Boom

from the beer-me dept

We've been on this for some time now, but the explosion in the craft brewing industry has led to a likewise explosion in trademarks for individual brews and breweries. It's a problem very specific to the craft brewing industry for a number of reasons. First, this trademarking practice deviates from the tradition in the industry, which was one in which craft breweries were largely amicable and permissive with their cleverly named beers. Second, the explosive growth is quickly running into a roadblock of language, in which only so many words can be combined to name brews, even as the number of those brews on offer continues its exponential growth. Third, and perhaps most importantly, craft brewing is now big business, such that many macro-breweries are now gobbling up craft breweries, and those macros tend to be more litigious and more often engage in trademark bullying.

It's why, for several years now, we've talked about the coming trademark disaster for the industry, including highlighting legal experts for that industry trying to sound the alarm bells. None of this has slowed down the problem however, with the latest being that, to nobody's surprise, 2018 was a record year for beer trademarks being granted in the UK.

The number of trademarks registered for beer in the UK has hit a record high in 2018, jumping 6% to 2,519, up from 2,372 in 2017*, says RPC, the City-headquartered law firm. RPC says the continued boom in demand for craft beer and an increased range of low-alcohol beers has driven up the number of trademark registrations.

RPC adds that the rise in beer trademarks is being further driven by the demand for low-alcohol and alcohol-free beer, which has resulted in a proliferation of new low-alcohol beer brands. This demand is partly driven by younger generations, more of whom are going ‘teetotal’ or choosing to cut back on their alcohol intake for health purposes. UK sales of non-alcoholic beer, wine and spirits reached a record high of £57m last year** - an increase of 39%.

This. Is. Not. Sustainable. It just simply isn't. If this industry is going to continue to grow, with that growth being good for literally everyone other than the largest breweries, this trademark-it-all attitude is eventually going to represent a brick wall. And we've already seen what this has meant for the industry, with a severe uptick in trademark disputes between breweries. Given how this industry operated for years and years, there is literally no reason why Techdirt's pages should be filled with stories about beer-related trademark disputes. And, yet, here we are.

And it's worth remembering that more trademarks mean exponentially more legal disputes, as overly aggressive legal teams see infringement shadows everywhere they turn.

RPC adds that as the number of beer trademarks continues to grow, so too does the likelihood of more legal battles over trade marks taking place. For example, Manchester based Cloudwater Brew was recently forced to rebrand its ‘Good Call Soda’ after Heineken said the name infringed on a trade mark it had registered for one of its brands, Fosters, for a TV advertising campaign.

Again, if you want to grow this industry, this is not the way to do it. It would be much better if the industry hadn't murdered its own tradition of congeniality in favor of permission culture.

Filed Under: beer, trademark, uk

Health Minister Wants Full-Genome Sequencing Of Every Newborn Child In UK To Become Routine

from the knowing-too-much dept

The cost of sequencing every DNA "letter" in a human genome has fallen faster than Moore's Law, from around $100 million in 2001, to under $1,000 today (although some say the overall cost in a clinical context is higher). This brings with it the prospect of routinely carrying out full-genome sequencing for everyone. That's precisely what Matt Hancock, the UK's Health Secretary, has said he wants to see as a part of the country's National Health Service (NHS), reported here by The Telegraph:

"My ambition is that eventually every child will be able to receive whole genome sequencing along with the heel prick test [a basic test for genetic conditions]," he told the conference.

"We will give every child the best possible start in life by ensuring they get the best possible medical care as soon as they enter the world. Predictive, preventative, personalised healthcare -- that is the future of the NHS -- and whole genome sequencing and genomics is going to play a huge part in that," he said.

Creating a massive database of near-complete genomes will probably ring alarm bells for Techdirt readers. Just recently, US police have started obtaining warrants to search entire DNA databases, even of people who opted out of allowing law enforcement to access their genomic data. That's despite the fact that "touch DNA" is mostly guesswork, and that crime lab testing is beset with problems. Moreover, a mistaken belief that DNA is infallible can lead to innocent people being charged with serious crimes like murder.

It's true that DNA can be a very powerful tool for solving crimes by finding distant matches in publicly-available genetic data, and then constructing family trees to narrow down the possible suspects. But that fact also exposes why routinely obtaining someone's DNA, as Hancock proposes for newborns in the UK, has an important impact on anyone related to the person whose whole genome is sequenced.

Even when DNA databases of a complete population are not set up for the purposes of mass surveillance, as Kuwait proposed (but then scaled back), and as China is implementing in Xinjiang as a way of controlling the local Uyghur population, there are other serious issues that need to be considered.

For example, the Telegraph article notes that full-genome sequencing of newborns means "parents could choose to be alerted to the fact their child faced heightened risks of specific diseases, and allow the NHS to offer more tailored treatment." But would parents necessarily welcome knowing that their child is more likely than the average individual to develop some serious genetic condition at some point in their lives? And what about if that condition had no treatment at present? What is gained by knowing of the risk? Might parents, and later the affected children themselves, find that knowledge almost too much to bear -- a genetic sword of Damocles hanging over them all their lives? Equally, parents might feel guilty if they don't ask for this information, which could allow for earlier treatment of diseases.

There's no doubt that full-genome sequencing will have a major impact on medicine in the decades to come, and offers the hope of more targeted and more effective medicines for many conditions. But for the benefits to be realized, doctors and genetic counselors will need to find effective ways to talk to people about what the detailed but probabilistic information revealed by their complete genomes will mean for their future health and treatments. Only then can we make informed decisions that enhance our well-being and happiness.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: babies, dna, health minister, matt hancock, nhs, privacy, surveillance, uk, uk health secretary

UK Hospital Somehow Manages To Turn A Patient's Private Message Into Its Voicemail Greeting

from the how-may-we-misdirect-your-call dept

We've covered a lot of data breaches on this site over the years. Most involve the leakage of personal info via unsecured databases or careless data handling. But I doubt we've covered anything as bizarre as this. (via Databreaches.net)

A Devon hospital has apologised after a caller’s voicemail, containing personal patient details, became the hospital’s answerphone message for more than seven hours.

During that time the caller was inundated with calls from patients giving details about their health problems believing they were ringing North Devon District Hospital in Barnstaple.

Somehow, through the magic/convolutions of business phone systems, the message a woman left while calling to set an appointment for her husband somehow became the message greeting callers who were unable to reach a live human being.

Adding inconvenience to possibly tortious injury, the hospital somehow managed to route a number of inbound calls to the person whose message it had accidentally co-opted, resulting in the person (who had yet to discover her personal information had been compromised) fielding phone calls from other patients, who ended up sharing their personal info with a complete stranger.

The woman, who asked not to be named, said: “I didn’t think any more of it until an hour and a half later an elderly man called our home phone talking about his private parts as he had a problem and had to have an operation.

“I said to him, ‘I’m ever so sorry but I don’t know what you’re talking about?’. He replied, ‘they have given me your number’.

The hospital's explanation for this incident isn't very reassuring. It places the blame on outdated equipment. Unfortunately for people who don't want their personal info handed over to complete strangers, there's no telling how many public and private entities could make the same claim about their phone systems.

She said: “The phone lines were redirected and I was told it was completely human error because some parts of the hospital are still using old answer machines."

And yet old answering machines are operated all the time without turning a message someone left into a voicemail greeting. Sure, it's not impossible. But good god is it ever unlikely.

Stupidity before malice, as the saying goes. There's no conceivable reason the hospital would want to generate this kind of press, so it would be irrational to think someone did this to deliberately harm this person. But harm was done nonetheless, and the combination of the UK's Data Protection Act and the GDPR could result in a pretty hefty fine for the hospital. The going rate is "4% of turnover [gross revenue]" -- something that has seen maximum fines rise from £500,000 (the amount charged Equifax) to £183 million (levied against British Airways).

Since the Devon hospital is unlikely to replace its hardware immediately, the risk of repetition still remains. Considering it's apparently never happened before, the risk is low -- but certainly not nonexistent. Adding humans to outdated tech will sometimes result in errors that aren't easily replicated. Given that we've heard nothing comparable to this in the many years this blog has been running, this hospital's inadvertent use of patient's sensitive message as its own answering machine greeting is likely to remain a data breach unicorn.

Filed Under: data protection, devon, health information, privacy, uk, voicemail
Companies: north devon district hospital