The decision by Scotland’s Crown Office not to prosecute Dr Andrew Jamieson for accessing the emergency care summary (ECS) records of well-known people is interesting. Despite the absence of a conviction, the case involving footballers, politicans and BBC journalists is significant because it shows that big centralised databases are the enemy of privacy.
Jamieson worked at Queen Margaret Hospital in Dunfermline where it was alleged he used the ECS system to look up the records of the prime minster, Alex Salmond, Jack McConnell, Celtic Football Club players, a newsreader named Jackie Bird and seven other BBC journalists.
Those involved were told last week that it would not be in the public interest to prosecute Jamieson following charges last March after the nature of the alleged breaches and medical reports on the accused had been considered. I suspect that one consideration was it was not in the victims’ interests that medical records were produced in court as evidence, which is understandable, yet it serves to underline the sensitiveness of the material that Jamieson is reported as saying he viewed it out of curiosity.
The temptation will always be there. The ECS records are uploaded from GPs’ surgeries every evening and contain information of demographic details, current medication, allergies and adverse reactions for about 5 million patients in Scotland. The system was launched in 2006 with the “highest standards of security” yet it clearly conforms to Cambridge professor Ross Anderson’s rule that a large, functional database can never be entirely secure (while a completely secure database can never be functional).
True, the health service were said to have spotted Jamieson’s activities quickly and informed all his alleged victims but the ease of any such breach must strike home to all those who have argued with such touching faith that the NHS Spine database is secure and patients should stop worrying about their privacy.
This impatience with reasonable doubt is a characteristic of all the advocates of the database state. We’re briskly told we should join the 21st century and that our privacy is a minor consideration in the delivery of joined-up services and connected government.
I guess it’s simply a matter of time before the children’s database, ContactPoint, is abused by one of the 300,000 people who will eventually have access to the names, addresses and personal details of the children in England and Wales. Indeed, the Telegraph reported this week that the database has suffered at least three security breaches before its nationwide launch.
ContactPoint is a two-tier database that places extra security around the children of famous people, but that doesn’t say much about the basic security offered by ContactPoint, does it?
The Jamieson affair is an important warning even though the decision not to prosecute will have the effect of sweeping it under the carpet.
guardian.co.uk © Guardian News and Media Limited 2010