Case Study - Data Destruction By Mr. B

Further Study • National Health Executive article about multiple NHS breaches:http://www.nationalhealthexecutive. com/Health-Care-News/nhs-breaches-patient-confidentiality-six-times-a-day
• The Guardian article about NHS’s mishandling of this data: https://www.theguardian.com/media-network/media-network-blog/2013/aug/19/nhs-surrey-data-breach-scandal
• Silicon.co.uk article about this breach: https://www.silicon.co.uk/workspace/nhs-surrey-ico-fine-200kdata-breach-121681

NHS Surrey fined £200,000 after losing patients' records - BBC News

You can open this webpage in a new tab.

Copy link

Open in new tab

Multiple Choice

When an incident like this occurs, responsibility typically lies with both parties involved: the original source (NHS Surrey) and the third-party destruction company. NHS Surrey failed to adequately monitor the destruction process, while the third-party company did not fulfill its obligation to securely dispose of the data.

Who is ultimately responsible when an incident like this occurs?

• Only the original source (NHS Surrey)

• Only the third-party destruction company

• Both the original source (NHS Surrey) and the third-party destruction company

• None of the above

Multiple Choice

When an incident like this occurs, responsibility typically lies with both parties involved: the original source (NHS Surrey) and the third-party destruction company. NHS Surrey failed to adequately monitor the destruction process, while the third-party company did not fulfill its obligation to securely dispose of the data.

Who is ultimately responsible when an incident like this occurs?

• Only the original source (NHS Surrey)

• Only the third-party destruction company

• Both the original source (NHS Surrey) and the third-party destruction company

• None of the above

Match

Steps to verify the destruction of provided systems should include implementing robust monitoring procedures to ensure compliance with data destruction protocols.

Match each step with its recommended action:

• Implementing robust monitoring procedures to ensure

• Contractual agreements with third-party vendors

• Regular audits of data destruction processes

compliance + data destruction protocol

outlining requirements for data disposal

ensuring data security during disposal

• compliance + data destruction protocol

• outlining requirements for data disposal

• ensuring data security during disposal

Multiple Choice

True or False:

Legal recourse for individuals affected by a data breach may include seeking compensation for damages through a civil lawsuit against the responsible parties for negligence in safeguarding personal information.

• False
• True
• None

Multiple Select

What can other organizations learn from this case study on data destruction incident?

• Implementing stringent data destruction protocols and ensuring compliance with industry regulations.

• Ignoring data destruction protocols to save time and resources.

• Using outdated data disposal methods without considering compliance standards.

• Not considering government-approved facilities for data destruction.

Draw

Draw or paint a sample of what would represent a case of data destruction!