The subject access request that cost a GP Practice £40,000.
A subject access request (SAR) is a formal request under the Data Protection Act (DPA)by an individual to be able to see the information held about them by an organization. An organization receiving such a request has obligations imposed by law to provide the information. However, the data does not always have to be provided and organizations must be careful when assessing any such request.
In the matter of the Regal Chambers Surgery (GP Practice) a husband and wife were divorced acrimoniously. The husband made a SAR to the GP Practice in relation to information about his son asking for details of his son’s medical records. The son’s mother had specifically requested the GP Practice not disclose information to the father about their whereabouts. The GP Practice receiving the request responded promptly and within 4 days provided the son’s medical records which also contained the mothers telephone contact details.
The father obtained the records which were filed in the ongoing legal proceedings.
The GP Practice had disclosed data not only in relation to the child but also in relation to his mother.
The ICO found that the data disclosed was highly sensitive; the GP Practice had not checked or distinguished between the data which should have and should not have been disclosed.
The ICO imposed a fine of £40,000 for the unlawful disclosure of the information.
Comment
Whether you are a GP Practice or any business which collects, process or stores personal data protected under the DPA; ensure you have procedures in place on how to handle SAR’s and ensure your staff are trained in these.
At Nath solicitors we deal with many GP surgeries and often see such requests which are also combined with issues and obligations of patient confidentiality. If you receive a SAR and are unsure of how to handle it, it is better to seek advice than make assumptions which may later turn out to be incorrect or costly.
Please note that the above in does not constitutes legal advice; for further information and advice contact Nath Solicitors on 0203 983 8278 or visit our website www.nathsolicitors.co.uk.
