Tweet
Potential Data Protection Act 1998 Breach
Hi all,
I have an issue I am hoping to get some input on.
Background
My local NHS Trust is a data controller as defined under section 1 of the Data Protection Act 1998 and is responsible for the processing of data of which I am the data subject.
In December 2015, I submitted a complaint to a psychotherapy regulator in regards to the one of the Trust’s psychotherapists.
The psychotherapist subsequently disclosed/shared my sensitive personal data to both the regulator and his representative whom he commissioned to assist him in defending the complaint. The psychotherapist nor the Trust gained my explicit consent.
The issues
My personal data was disclosed/shared with the regulator and the psychotherapist's representative. This data is defined as sensitive personal data under section 2 (e) and section 2 (h) of the Data Protection Act 1998.
The 1st data principle is set out as follows:
“1 Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless—
(a) at least one of the conditions in Schedule 2 is met, and
(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.”
The Trust have failed to demonstrate at least one of the conditions in Schedule 3 was met. I have lodged a formal NHS complaint and they simply argue the sharing of the data "was relevant and pertinent to the issues".
Moreover, the Trust have failed to have regard for the lawfulness of the disclosing/sharing of the data, particularly in relation to confidentiality laws.
Moreover and on the face of it, the psychotherapist has contravened section 55 of the Data Protection Act 1998.
Is there a a cause of action? I have sent the ICO a concern but they really are a toothless bunch.
Also, the Trust's solicitors have been very evasive and elusive in responding to my letter before action. They argue the Trust has already taken all "reasonable and proportionate steps" as required under the pre-action protocol/Practice Direction and fail to offer a full and detailed defence. I should be grateful for any assistance here.
Many thanks.
I have an issue I am hoping to get some input on.
Background
My local NHS Trust is a data controller as defined under section 1 of the Data Protection Act 1998 and is responsible for the processing of data of which I am the data subject.
In December 2015, I submitted a complaint to a psychotherapy regulator in regards to the one of the Trust’s psychotherapists.
The psychotherapist subsequently disclosed/shared my sensitive personal data to both the regulator and his representative whom he commissioned to assist him in defending the complaint. The psychotherapist nor the Trust gained my explicit consent.
The issues
My personal data was disclosed/shared with the regulator and the psychotherapist's representative. This data is defined as sensitive personal data under section 2 (e) and section 2 (h) of the Data Protection Act 1998.
The 1st data principle is set out as follows:
“1 Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless—
(a) at least one of the conditions in Schedule 2 is met, and
(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.”
The Trust have failed to demonstrate at least one of the conditions in Schedule 3 was met. I have lodged a formal NHS complaint and they simply argue the sharing of the data "was relevant and pertinent to the issues".
Moreover, the Trust have failed to have regard for the lawfulness of the disclosing/sharing of the data, particularly in relation to confidentiality laws.
Moreover and on the face of it, the psychotherapist has contravened section 55 of the Data Protection Act 1998.
Is there a a cause of action? I have sent the ICO a concern but they really are a toothless bunch.
Also, the Trust's solicitors have been very evasive and elusive in responding to my letter before action. They argue the Trust has already taken all "reasonable and proportionate steps" as required under the pre-action protocol/Practice Direction and fail to offer a full and detailed defence. I should be grateful for any assistance here.
Many thanks.
Comment