Slashdot Mirror
UK's Largest Online Pharmacy Sold Patients' Personal Data To Fraudsters (ibtimes.co.uk)
Ewan Palmer writes: The UK's biggest online pharmacy has been fined $200,000 for selling thousands of patients' personal data to scammers who targeted the sick and vulnerable. Pharmacy2U (P2U) was found to have breached the Data Protection Act for giving away details of patients to Australian Lottery fraudsters who targeted male pensioners and health supplements company that has been cautioned for misleading advertising. A company who dealt with patients who were being marketed said they had 'no idea the trade in their data was as murky as this'.
that's all I have to say.
oh, and any business that lets medical info about patients be hacked should be forced to go out of business and the ceo's and c-levels all should be put in jail.
if we did that, over night the security of such places would be 100% better. since there is no penalty to being incompetant, they continue to be as such.
only if there is personal pain for the c-levels would anything like this change.
--
"It is now safe to switch off your computer."
They don't care. No one cares. Why?
because FUCK YOU, that's why! What do you think you can do about it?
I would love to see the laws changed to reflect how heinous crimes like these really are. If you expose the names, addresses, and private medical information to third-parties without consent -- and for profit -- you should lose your business, your bank account, and anything purchased with monies made from the illicit activity.
I'm tired of seeing people get lax sentences. Ditto drug dealing. If you sell drugs to a minor child and it's proven, you get a rope around your neck. Ditto rape, incest. Too many criminals have nothing stopping them. Public executions and public beatings would curb a great deal of crime.
Wow, only $200k, and only because of EU privacy protections that half the country are so desperate to exit? seems worthwhile to do it again.
I've never understood why the NHS contracts out to private pharmacies - just dispense directly and stop throwing money away on the profits of middlemen. It's not the 1950s anymore and, as consolidation of big business has illustrated, it's more efficient to run established industries on a huge scale with continually optimised, automated algorithms, and competition is a needless and inefficient risk. Mind you, I don't get why they haven't in-housed GP surgeries either, as the relentless drive of GPs to become more short-termist business-like and become seduced by increased salary in return for unsustainable conditions has created a crisis in primary practice.
Please confirm me this is a per patient fine...
Even when you're not the product, you're the product. I would go on, but I have an urge to go buy some LightSpeed Briefs.
Pretending this is my office full of bitter coworkers..
I don't think the fraudsters angle of this story should matter. The issue is;
UK's Largest Online Pharmacy Sold Patients' Personal Data.
But, what are they gonna do. Absolutely nothing will happen to the offending corporation despite your outrage.
"Pharmacy2U (P2U) was found to have breached the Data Protection Act for giving away details of patients to Australian Lottery fraudsters who targeted male pensioners and health supplements company that has been cautioned for misleading advertising."
Say what?
It seems that Europe should look closer to home for data-villains. This was a UK company and an AUS company that were buying and selling HIPPA-excluded content. In the USA the Federal government would penalize such a thing out of existence and put the deciders in prison.
Perhaps safe data in Europe is really political propaganda?
I'm pretty sure they got more than 200'000$ profit from selling this information.
That fine is ridiculous, the executives probably had it as just another line on their expenses budget, right under "coke, strippers and champagne - 300'000$"
So the article says these folks sold about 21K of their customers' records and were fined $ 200K.
Am I mistaken or this means that each customer's privacy's worth a little under $10.00?
Hell, that's cheaper than paying baksheesh to politicians.
This sounds like a mere cost of doing business, like replacing ceiling lamps.
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
Sufficiently advanced creative accounting is indistinguishable from fraud. ---Arthur C Clarke.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
I'm not against criminal punishments for these CEOs and better regulation, but there's no reason we can't tackle this problem from multiple angles.
Would you be willing to pay slightly more for medical care and/or drugs if the provider placed a deposit with a reputable third party? If your data is sold/leaked/hacked or made public for any reason within X decades, you are then paid their deposit. This deposit should be several times more than the increase in price, since a breach is hopefully unlikely.
What about third party leak insurance? That way if you don't care about your privacy you don't have to buy it, but if your privacy is worth something to you you can insure against it leaking. Less trustworthy pharmacists would cause higher insurance rates, which is itself useful information. Insiders/hackers can already profit by selling personal info; this would help them profit by preventing a leak too.
Both of these solutions assume the damage from a leak is greater than the benefit to CEOs/hackers/advertisers/fraudsters, and that there are at least some rational health care consumers. Maybe Augur and darknet markets can test this out before normal people are subjected to it - a lot of drug data was leaked by the Silk Road.
If the courts would get of their butts and do their damn job instead of just pretending they are, then companies that do things like this would be seriously punished and so highly motivated to not do that in the future.
Not deliberate? They advertised the records for sale and then sold the records to the fraudsters. It wasn't like their systems were hacked. This is like if I offer to watch my neighbor's house and then rent the house to my friends to throw a party in. "I'm sorry your house was trashed. This wasn't deliberate. All I did was sell my friend a copy of the key to your house for $50. Clearly, I wasn't to blame for this incident."
My sci-fi novel, Ghost Thief, is now available from Amazon.com.
for at least five years. And that should mean both the business as well as the executives involved in the deal, no matter whose flag they fly.
Interesting. We are continually told that UK/EU data protection laws are sooo much better than in the US and elsewhere, and this type of thing can never happen.
Why is the fine so tiny? One would think the fine would be big enough to bankrupt the offending company.
Hey, that actually makes it a viable business.
1. Sell medical supplies at cost.
2. Watch people swarm you to get your cheap stuff, handing over any and all info you might want (and then some, because CHEAP!).
3. Sell their data to any and all fraudsters that could possibly want it.
4. If (and only if) someone in government wakes up and dares to move against a business for a change, pay a pittance to shut them up.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
That's why I buy all my medical supplies from v1agra4u2fuck.com