A serious data leak occurred at a GP surgery which resulted in an ICO investigation and a fine.<\/p>\n
Mr A was the estranged ex-partner of the mother of his 5 year old son (Child B). The practice had been warned by the child’s mother not to let Mr A know of the whereabouts of Child B and her family because of family problems. This information was noted on the child’s medical records.<\/p>\n
However, Mr A made a request to have the child’s medical records and provided a court order to show that he had parental responsibility. The practice did not have an adequate written procedure on how to deal with such a case, which resulted in Mr A being sent all of Child B’s medical records four days after the request had been made.
\n
\nThe medical records contained information that was sensitive and personal, such as the mother of Child B’s contact details; her parents information; and the information about Child C, who was not a blood relative of Mr A. Child protection reports and correspondence with the social services were also included.<\/p>\n
These documents were then filed by Mr A in court proceedings between the parties, where the mother of Child B received them, which included the child\u2019s medical records.<\/p>\n
The court found that the Practice had failed to take appropriate organisational measures against the unauthorised processing of personal data; contrary to the Data Protection Act.<\/p>\n
The practice did not have an adequate written procedure for requests such as the one in this case. The person who was in charge of the disclosure process did not receive any insight or supervision which would have enabled the person who disclosed the information to be able to distinguish what information should and should not have been disclosed.<\/p>\n
The Commission considered it to be a serious breach due to the high sensitivity and nature of the information that was disclosed, and steps should have been taken by the practice to ensure that such failures did not happen.<\/p>\n
A serious data breach has taken place by disclosing all of Child B’s information to Mr A, as well as the other information too. This disclosure was likely to cause distress and it should have been envisaged what could have happened, and steps to prevent those risks from happening should have been assessed.<\/p>\n
It has been decided that a monetary penalty should be enforced on the practice given the circumstances. It is believed that, by enforcing a penalty, it will prevent such occurrences happening in the future.<\/p>\n