Martin Swan had worked as a service advisor at the NHS 111 call centre in Southall. Mr Swan had a disagreement with a caller, which resulted in a complaint being made. The complaint prompted Mr Swan to access the records of the caller and his son.
To lawfully process personal data, you need to demonstrate that one of the six lawful bases apply, see our blog here. Mr Swan did not have consent to access the records, nor was he able to demonstrate that one of the other six lawful bases applied. To make matters worse, at an internal investigation meeting in June 2016, Mr Swan produced screenshots of the child’s patient notes.
Were Mr Swan’s actions in contravention of the UK GDPR and/or the Data Protection Act 2018 (DPA 2018)? It is first necessary to establish whether the records accessed by Mr Swan would be considered personal data in line with the definition present within the UK GDPR. Article 4 (1) of the UK GDPR defines personal data as:
“any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person”.
In Mr Swan’s case, he accessed medical records which most likely would have referred to the patients by name and address. The records were also likely to contain other identifiers such as information in relation to the patient’s physical attributes.
Section 170 of the DPA 2018 (formerly Section 55 of the Data Protection Act 1998) states:
“(1) It is an offence for a person knowingly or recklessly-
(a) to obtain or disclose personal data without the consent of the controller,
(b) to procure the disclosure of personal data to another person without the consent of the controller, or
(c) after obtaining personal data, to retain it without the consent of the person who was the controller in relation to the personal data when it was obtained.”
Section 196(2) of the DPA 2018 confirms that a person who commits an offence under Section 170 of the DPA 2018 is liable on summary conviction to a fine, and on conviction on indictment to a fine. In accordance with Section 196(4) of the DPA 2018, the Court may also order a document or other material to be forfeited or erased if it has been used in connection with the processing of personal data and it appears to the Court to be connected with the commission of an offence.
Mr Swan failed to attend an initial hearing in April 2018, a warrant was therefore issued for his arrest. He surrendered to warrant in January 2023 and appeared before Uxbridge Magistrates Court on 15 February 2023. Mr Swan’s defence counsel told the Court, “in the run up to the decision making he did access material he should not have accessed at that time – it’s not for any sinister purpose but for the tribunal process.”
Mr Swan pleaded guilty to five counts of unlawfully obtaining personal data in breach of Section 170 of the DPA 2018. He was fined £630 with a victim surcharge and Court costs totalling £1,093.
Andy Curry, ICO Head of Investigations commented:
“When seeking medical help, people should never have to think twice about how their information is handled and whether their patient records are secure.
The NHS 111 helpline offers a valuable service and people need to trust that the handlers operating this service are being responsible with the details provided.
The case shows that the ICO will take action when personal records are accessed unlawfully. As well as being an invasion of privacy, these actions seriously jeopardised the trust built between the service and its users.”
How can we help
Ruby Ashby is an Associate in our expert Dispute Resolution team.
If you need any advice concerning the subjects discussed in this article, please do not hesitate to contact Ruby or another member of the team in Derby, Leicester, or Nottingham on 0800 024 1976 or via our online enquiry form.
Contact us