I shall be writing to my local MP about this, I'd encourage anyone else to do the same!
NHS England patient data 'uploaded to Google servers', Tory MP says
21–30 of 184 posts
Re: NHS England patient data 'uploaded to Google servers', Tory MP says
#22It's worse than that: Ben Goldacre is reporting ( https://twitter.com/bengoldacre/status/440475049880195073 ) that the data was made publicly available. This is beyond parody.
another update:
"No individuals directly named records online. But a massive breach of the most basic information security policies to prevent jigsaw."
Re: NHS England patient data 'uploaded to Google servers', Tory MP says
#23This is the data in question: http://www.hscic.gov.uk/hes It is anonymised [1], publicly licensable data. Here are a list of users and uses. [2] [1] "We apply a strict statistical disclosure control in accordance with the HES protocol, to all published HES data. This suppresses small numbers to stop people identifying themselves and others, to ensure that patient confidentiality is maintained." [2] http://www.hscic.g…
> It is anonymised
Not meaningfully, no. A UK postcode covers 20 households or less. If you have that plus gender and date of birth (as seems to be the case here), you almost always have a unique individual.
Re: NHS England patient data 'uploaded to Google servers', Tory MP says
#24Surely PA Consulting should immediately be sued out of existence. This kind of behaviour must be considered beyond negligent, practically criminal. I would strongly support throwing anyone involved in this into jail for a long time as a deterrent against future criminals. This is just unbelievable.
Given it is now run by the ex head of Barclays Bank and is the second largest recipient of government contracts in the UK, I wouldn't hold your breath.
Re: NHS England patient data 'uploaded to Google servers', Tory MP says
#25This is the data in question: http://www.hscic.gov.uk/hes It is anonymised [1], publicly licensable data. Here are a list of users and uses. [2] [1] "We apply a strict statistical disclosure control in accordance with the HES protocol, to all published HES data. This suppresses small numbers to stop people identifying themselves and others, to ensure that patient confidentiality is maintained." [2] http://www.hscic.g…
> It is anonymised Not meaningfully, no. A UK postcode covers 20 households or less. If you have that plus gender and date of birth (as seems to be the case here), you almost always have a unique individual.
NHS number, date of birth, postcode, ethnicity and gender.
Is about as anonymous as wearing a different hat.
Re: NHS England patient data 'uploaded to Google servers', Tory MP says
#26Good. Imo, the fearmongering here is actually quite irrational. Google have more credibility (and money) to lose from a high publicity hack than government contractors who already act with impunity. If they'd invested in their own own map-reduce deployment we'd only be hearing another story about government contractors wasted millions of £ in taxpayers money on Big Brother data analysis.
> The extracted information will contain a person's NHS number, date of birth, postcode, ethnicity and gender.
Big woop? Your NHS# isn't used outside of the NHS or for anything of concern to most people, and your postcode (and address) is held on the unedited electoral roll by hundreds of organisations. Most people don't even opt-out of the edited register accessible for a small fee on 192.com
Why aren't us Brits worried about our credit histories and county court judgements being recorded and held by Equifax, an American company?
What specifically are people actually afraid of with regard to this data set sitting on Googles servers? I just don't get the regular public outcry about NHS data.
Re: NHS England patient data 'uploaded to Google servers', Tory MP says
#27Surely PA Consulting should immediately be sued out of existence. This kind of behaviour must be considered beyond negligent, practically criminal. I would strongly support throwing anyone involved in this into jail for a long time as a deterrent against future criminals. This is just unbelievable.
Surely the people in power should have paid more attention to this before handing the data to a private third party. Those who ignored the problem before it emerged should not be allowed near position of decision for public office.
Rant apart, this seriously raise the question of do we not need to have an alternative (maybe a pan European subsidized, not for profit organization) to Skynet (sorry I meant Google)?
Re: NHS England patient data 'uploaded to Google servers', Tory MP says
#28Surely PA Consulting should immediately be sued out of existence. This kind of behaviour must be considered beyond negligent, practically criminal. I would strongly support throwing anyone involved in this into jail for a long time as a deterrent against future criminals. This is just unbelievable.
According to them, they got approval for doing that:
> The alternative was to upload it to the cloud using tools such as Google Storage and use BigQuery to extract data from it. As PA has an existing relationship with Google, we pursued this route (with appropriate approval). This showed that it is possible to get even sensitive data in the cloud and apply proper safeguards.
Re: NHS England patient data 'uploaded to Google servers', Tory MP says
#29Surely PA Consulting should immediately be sued out of existence. This kind of behaviour must be considered beyond negligent, practically criminal. I would strongly support throwing anyone involved in this into jail for a long time as a deterrent against future criminals. This is just unbelievable.
According to them, they got approval for doing that: > The alternative was to upload it to the cloud using tools such as Google Storage and use BigQuery to extract data from it. As PA has an existing relationship with Google, we pursued this route (with appropriate approval). This showed that it is possible to get even sensitive data in the cloud and apply proper safeguards.
[deleted]
Re: NHS England patient data 'uploaded to Google servers', Tory MP says
#30Surely PA Consulting should immediately be sued out of existence. This kind of behaviour must be considered beyond negligent, practically criminal. I would strongly support throwing anyone involved in this into jail for a long time as a deterrent against future criminals. This is just unbelievable.
I would strongly encourage everybody to contact the Information Commisioners Office, as this must be a breach of data protection ? https://ico.org.uk/Global/contact_us If anybody has details about how this may be a breach of the data protection act exactly, then please post below.
It's one of the main points of the DPA - Not transferred outside the UK without adequate protection
https://www.gov.uk/data-protection/the-data-protection-act
Although that is more speculation than anything, as we don't have any knowledge if the information was encrypted or not, or any other safe guards in place. But the fact it took them nearly 2 weeks to upload 129.6GB or 229.5GB (Article states DVD's nothing else) I wouldn't be surprised if there were none in place.