The number of data breaches at Scottish health boards has risen by a third since the introduction of a system intended to reduce them, it has emerged.

Figures obtained by the Scottish Conservatives under freedom of information revealed more than 6,000 breaches of General Data Protection Regulations (GDPR) in the last five years. 

The number of GDPR breaches has grown by almost a third since statutory recording of them began, from 1,028 in 2018 to 1,354 last year. 

The figures cover 13 of Scotland’s 14 regional health boards, with only NHS Forth Valley failing to return data to the Tories.

The largest number of breaches occurred at Scotland’s largest board, NHS Greater Glasgow & Clyde, with 1,637 out of the national total of 6,336 . 

Under the GDPR regime, organisations handling people’s personal data must use it “fairly, lawfully and transparently… in a way that ensures appropriate security, including protection against unlawful or unauthorised processing, access, loss, destruction or damage”.

Breaches include “the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data”. 

In the context of the NHS, the breaches recorded in the last five years include letters and emails sent to the wrong addresses, data sent to the wrong printers, thefts, unauthorised access of patient information and rare cases of hacking and employee sabotage.

Earlier this year NHS Highland was reprimanded after a data breach showed the personal email addresses of almost 40 people likely to be accessing HIV services to others.

The Information Commissioner’s Office called it a “serious breach of trust”.

Tory MSP Dr Sandesh Gulhane said: “This alarming surge in data breaches is unacceptable – patients need to have confidence that their personal information is safe and secure.

 “Health boards must ensure that appropriate measures are taken to avoid personal data being compromised.  

“But this growing problem is just another symptom of the SNP’s mismanagement and under-resourcing of Scotland’s NHS.

“Patients and staff – whether clinical or administrative – are being let down by ministers, who should follow the Scottish Conservatives’ vision for a modern, efficient local health service.”

A Scottish Government spokesperson said: “The privacy of all patients is paramount. The Scottish Government expects NHS Boards and other partners to protect and respect patients’ rights at all times.

“Public bodies need to maintain good working relationships and meet UK GDPR obligations when sharing appropriate information.”