GDPR and Data Protection Act

[rumpole2018]

Hi everybody, I made a Subject Access Request to Mediscan Diagnostics in respect of an ultrasound scan I had with them.
I will try to condense everything that has happened.
I made the SARS in November 2018.
First, they told me I had to pay.
the Information Commissioners Office advised them that it was free.
Then they said protocol dictates that I get the files from my doctor.
The Information Commissioners Office then made an assessment against them.
They then ignored all my emails.
The Information Commissioners Office again made an assessment against them and still no joy.
The Information Commissioners Office advised me that they do not have the power to order them to comply but that they only do assessments!
I made an application to the 1st Tier Tribunal who advised that they have no power to make Mediscan give me my data nor that they have the power to make the Information Commissioners Office order Mediscan comply with the Data Protection Act! (See attachment)
The 1st Tier Tribunal confirmed that the Information Commissioners Office had no enforcement power over the assessment and that my only recourse was to take legal action against Mediscan! Yes, I have this in writing! See attachment.
So I complained to Wigan Borough CCG stating that their contract with Mediscan states that Mediscan must comply with data protection laws.
Wigan Borough CCG wrote back advising that they were only a signatory to the contract and that the main contract holder was Manchester CCG!
xxxxx, xxxxx (NHS WIGAN BOROUGH CCG)

Dear Mr XXXXXXXXX
I have now had a response from our contracting team here at the CCG as follows:
“There are a range of General Conditions in the NHS standard contract around ‘Patient Confidentiality, Data Protection, Freedom of Information and Transparency’.
The following simple extract may be relevant:
Information Governance – General Responsibilities
21.1 The Parties must comply with Data Protection Legislation, Data Guidance, the FOIA and the EIR, and must assist each other as necessary to enable each other to comply with these obligations.
However, Wigan Borough CCG is not the lead commissioner for this service. We are only an associate to the contract.
The lead commissioner is Manchester Health & Care Commissioning (Manchester CCG).“
I would expect that Manchester’s powers to intervene are quite limited in what is an individual dispute between you and Mediscan. You have already exhausted two layers of regulation and scrutiny – the ICO and First Tier Tribunal and it would appear that legal action would be the only remaining course open to you.
am sorry that we are not able to help you further in what must be an extremely frustrating set of circumstances.
Yours sincerely
xxxxxxxxx
Assistant Director, Governance
NHS Wigan Borough CCG
tel 1111111111
xxxxxx@nhs.net

www.wiganboroughccg.nhs.uk
At this point, I became aware that Mediscan had replied to my NHS review.
https://www.nhs.uk/Services/Trusts/R...backID=2507312
So, I emailed Faika Khan Complaints/Performance Manager for Mediscan and informed him of the situation.
Apologies were made and "I will honour your Subject Access Request".

MEDISCAN, Feedback (MEDISCAN DIAGNOSTICS SERVICES LIMITED)
Mon, 12 Aug, 13:46
to xxxxx
Hi Mr. xxxxx,
I could not track your request for the images in our system. Can you please share where had you sent your request ( email ID / Address ).
Please share you NHS number and Date of Birth to track the reports.
We honour your request and if you will send us your details we will take appropriate actions to investigate how the delay was caused.
Regards,
Complaint Management Team
Mediscan Diagnostic Services

Sometime later I got an email asking me more for more details as they could not find me in the system!
I give all the details including my NHS number.
Since that time I have emailed 3 times asking for an update and get no reply"
So, I made a complaint to Manchester CCG!
I had email and phone contact with Manchester CCG!
Now again all contact has ceased.
Emails are only answered with " I will pass it on to the investigating officer".
I am now of the firm opinion that Mediscan has "lost" my medical record and I am pretty sure that mine is not the only medical record they have lost!
I suspect that there has been a serious breach of many, many patients medical records.
I am also of the opinion that the powers that be from on high, are covering up all this as it could turn out be a great big scandal. PS: I am not normally a conspiracy theorist!
There is a lot more to this than meets the eye!
Look at all the 5 pages of reviews!!!!!!!!!!!!!!!!
https://www.nhs.uk/Services/Trusts/R....aspx?id=90853
Mediscan is the NHS main provider of medical diagnostic services.
I have all the email correspondence between myself all parties to this debacle.
I can furnish all correspondence on request if so, required to prove all that I have said.
I am going to instigate legal action against Mediscan but I need to know the specifics of which act etc, to put on the claim form.
I have used the legal system before so I do have some knowledge.
Or, I am willing to pay for help to have the claims form professional drafted or pay full stop for a good data protection solicitor to do it all for me.
I can not believe what is happening here.
If you have any medical dealings with Mediscan you might want to make a SARS and see what happens!
Should be an interesting topic this one...

[efpom]

If I understand your writing correctly, you contend that you have a proprietorial interest in the 'goods', the goods being the scan and any other relevant document. In the alternative, you contend that you have a proprietorial interest in the information in the document(s).

The question then becomes: How can I prove that interest?

The answer to that, seems to me to be the acceptance by your potential opponent that you do have a proprietorial interest and that they are trying to find the' goods'.

If I am right so far, then all you need is an Order from the court compelling your opponent to handover the goods. I leave to others to suggest by what route, such an Order should be applied for.

[rumpole2018]

The Information Commissioners Office has assessed that they are in breach of the Data Protection Act.
So I presume that I would be taking legal action against Mediscan Diagnostics for the breach of my legal rights under that act.
Always open to different views and thanks for the reply.

[efpom]

If you proceeded under Art 82 GDPR, you would have to prove damage. What do you consider that damage was?

[rumpole2018]

At the moment I am not after damages but rather a compliance of the law.
I want to get the court to order Mediscan to give me my medical records as per the law.
If they can not, the question will become why?
At that point, Mediscan will have to cough up and admit that they have lost my records and then I can make an informed decision about what to do next.

[efpom]

You do not enjoy either the authority or power to enforce compliance with the law.

What you may have is a right of action either based on a proprietorial right or under Art 82 GPDR - in fact The Data Protection Act 2018, which transposed the Directive into national law

On the proprietorial right, you would have to prove that this arises under contract or under some other proposition of law. Certainly, if here was a contract between you and the entity that did the scan, I would have no doubt about that. I am not sure, that if you underwent treatment via the National Health Service, that you do have a proprietorial right to the documents.

On Art 82 you have to prove damage. I do not see how, if the documents were 'lost' you have suffered any damage, assuming that the treatment you underwent, that this diagnostic scan aided, was not affected by such 'loss', except, possibly, nominal damages in the range £20 to £100.

[JCE]

What you may have is a right of action ... under ...The Data Protection Act 2018, which transposed the Directive into national law

The infringement of the data subject's right might fall under section 45 DPA 2018 (Right of access by the data subject), requiring a court order under section 167 DPA 2018 (Compliance orders) and the damages following from that most likely would fall under s.168/169 DPA 2018

On Art 82 you have to prove damage.

As I'm facing a similar issue - have you got any authorities (precedents) stating under Art 82 GDPR one has to prove damages?

I do not see how, if the documents were 'lost' you have suffered any damage, assuming that the treatment you underwent, that this diagnostic scan aided, was not affected by such 'loss', except, possibly, nominal damages in the range £20 to £100.

Quite a few professionals have been commenting on these issues recently -
here is just one of many which suggests the level of damages even under the old DPA was in the region of £750-1000 for one-off breaches.

[rumpole2018]

Just to let you all know that what I did was contact the local health authority and told them that they have a contract with Mediscan and under the contract rules Mediscan has to follow applicable laws. Guess what, I got my files! Come form a different angle and fire. worked for me. all the best