HIV Scotland fined £10,000 for email data breach

The breach involved an email sent to 105 people

HIV Scotland has been fined £10,000 after the charity sent out an email containing the personal details of dozens of people.

The data protection breach involved an email to 105 people, including patient advocates representing people living in Scotland with HIV.

All the email addresses were visible to recipients, and 65 of the addresses identified people by name.

The Information Commissioner's Office (ICO) issued the penalty after a probe.

The watchdog said an assumption could be made about individuals' HIV status or risk from the personal data disclosed.

HIV Scotland runs projects aimed at preventing the disease and raising awareness about it. It also offers support in getting treatment.

New interim chief executive Alastair Hudson said the charity took full responsibility and apologised unreservedly to anyone who had been affected by the data breach.

• HIV patients hit by NHS email privacy breach

The ICO said its investigation of the incident in February this year found shortcomings in the Glasgow-based charity's email procedures.

These included inadequate staff training, incorrect methods of sending bulk emails and an inadequate data protection policy.

It also found that despite the charity's own recognition of the risks and the procurement of a more secure system for bulk messages, it was continuing to use a less secure method seven months later.

Ken Macdonald, head of ICO regions, said: "All personal data is important but the very nature of HIV Scotland's work should have compelled it to take particular care.

"This avoidable error caused distress to the very people the charity seeks to help."

Mr Hudson, of HIV Scotland, said a new team and board of trustees had taken "robust steps" to improve information security.

He said: "For a small charity, financially, I cannot deny that this is a heavy blow. However, we will find a way to pay the £10,000 fine to the ICO.

"As an organisation, HIV Scotland would like to re-iterate its commitment to providing a safe and supportive space where our stakeholders and networks can contribute to better health and wellbeing for those impacted by HIV and improving sexual health for all."