Not all cases involving illegal access or distribution of a person’s personal data, such as medical records, involve malicious intent.
Many people have fallen victim to negligent disclosure of their records by organisations which have failed to comply with the strict requirements of The Data Protection Act.
An example of this is a case which my firm brought on behalf of Mr CW of Liverpool in 2014.
Mr CW was a patient at the Aintree Group Practice in Liverpool, and there was another patient at the practice of the same name, but whose other details including date of birth and address were different.
This other patient was involved in family law proceedings in the course of which his legal representatives requested his medical records from the practice. Aintree practice then mistakenly supplied my client’s records to the firm of Solicitors acting in the family proceedings for the other individual of the same name as my client.
In the course of these family proceedings CW’s medical records were disclosed to all the parties to the litigation and their legal representatives as well as other professionals participating in the proceedings. My client’s medical records were relied upon in these proceedings and were referred to in open Court, including a number of highly sensitive problems which had affected CW in the past including depression for which he had required medication and counselling, and addiction including a problem with gambling.
It was only during the course of the Court hearing that the error was discovered and it was realised that these records related to an entirely different individual from the person who was involved in the family case.
The disclosure of CW’s confidential records by his GP clearly amounted to a breach of the data protection act as well as breach of confidence and misuse of personal information.
CW instructed my firm and we pursued a claim for compensation. The disclosure of his medical records to a large group of people caused CW substantial distress, anxiety and concern. Personal identifying information was disclosed to individuals who were complete strangers to CW. Highly sensitive and personal details about his life were included in this information, which was referred, and relied upon, in open Court.
We were extremely concerned that the medical practice, which is entrusted with guarding the highly sensitive data of hundreds of patients had been extremely lax in its implementation of data protection regulations and we questioned what policy the practice had in place relating to protection of patient information so as to prevent unauthorised disclosure and what steps or measures the practice had now implemented to improve its technical or organisation set up so as to prevent future unauthorised disclosure of information to third parties.
My client sought compensation in respect of the hurt, loss and injury caused by the negligent conduct of his GP practice.
In pursuing this case on behalf of CW we relied upon the decision of the European Court of Human Rights in the case of LH v Latvia –
The Court reiterates that the protection of personal data, not lease medical data, is of fundamental importance to a person’s enjoyment of the right to respect for his or her private life as guaranteed by article 8 of the convention. Respect in the confidentiality of health data is a vital principle in the legal systems of all the contracting parties to the convention. It is crucial not only to respect the sense of privacy of a patient but also to preserve confidence in the medical profession and in the health services in general.
Compensation has been awarded by the ECHR in a variety of cases for disclosure of confidential medical information. In the case of I v Finland 8,000 Euros were awarded where an employer revealed to some of an individual’s colleagues that she had HIV.
The case of CW was not dissimilar. CW suffered from depression and anxiety and had received counselling. These are clearly very sensitive matter similar to a revelation to strangers that an individual suffers from a serious illness like HIV.
CW’s claim against his GP was settled in June 2014 for payment of £4,000 damages plus legal costs.