ICO slapped data blabbers with £2m in fines last year

"Some patients told their GP that they objected to having their data shared. However, despite these objections, data sharing has taken place. We have secured a legal undertaking from HSCIC to put measures in place to better respect patient objections," it said.

The cash penalty isn't any incentive to change - it's not their money. In fact, it's ours the taxpayer's. So we get stuffed on a data breach and we pay for it thereafter.

Does that legal agreement now include prison sentences for future breaches? Because the totally crappy side of data escaping into the 3rd party system is that we can never be reassured that it has been fully eradicated from the system, never feel fully reassured that the data is not somehow still be used for purposes other than what it was originally intended for.