The Scottish Ambulance Service has apologised to staff in Moray after a “serious” data information breach.
The SAS has launched a “detailed investigation” into how confidential details of employees were left in a garage in Forres.
Moray MP Douglas Ross has raised the issue with SAS bosses after being contacted by a whistleblowing member of staff.
It is claimed documents containing personal information about employees were allegedly removed from a file within a local manager’s office.
Mr Ross was told that the notes were read by members of staff and then discarded into a cardboard box and placed into a storeroom.
It is claimed the box was later transferred to the SAS base in Forres and left in an SAS garage where workers were again able to view the contents.
Mr Ross said: “This appears be a serious breach of GDPR regulations on the safe storage of sensitive and confidential material.
“It is very concerning to me that this has happened within what should be secure areas of Scottish Ambulance Service premises in Moray.
“The fact that these documents seem to have been passed around some of the staff is worrying.
“I have made clear in my communication with the SAS that instances like this can be very damaging for staff morale.
“Staff confidence in the ability of the SAS to securely store confidential material will also be seriously undermined.
“The SAS is, however, taking this seriously and a full and detailed investigation is now underway.”
After being contacted by the Press and Journal, a spokesman added: “Our Information Governance Team were alerted to an incident involving personal information of staff which was discovered on a secure ambulance service premises.
“There is no evidence that these files have been accessed by anyone outwith the ambulance service and the files have since been removed to a secure location.
“A detailed investigation is ongoing and in line with legislative requirements, SAS has also notified the Information Commissioner’s Office who are reviewing the incident.
“SAS has informed the employees whose information is involved, have apologised and are providing ongoing support. We will be reviewing all learnings from this full investigation and will implement any actions identified.”
“Following the reporting of the incident, the files were removed to a secure location.
“SAS has informed the employees whose information is involved, have apologised for this incident and are providing ongoing support for all staff concerned.
“Our Data Protection Officer spent two days in the station concerned, speaking to staff, talking to them about the process and progress of the investigation, providing reassurance and offering them support.
“Local management teams are continuing this support and our data protection team are keeping in close contact with all staff to keep them informed as the investigation progresses.
“We will be reviewing all learnings from this full investigation and will implement any actions identified.”
An ICO spokesperson said: “We have received a data breach report from the Scottish Ambulance Service and we are making inquiries.”
