Unauthorised access to personal data: your rights and the compensation you may be able to claim

When an employee looks at someone’s personal information without a genuine work-related reason, it is not harmless curiosity. It can be a serious breach of privacy, data protection law and the trust placed in the organisation holding the records.

This issue has received renewed attention following reports concerning the medical records of three-year-old Noah Woods. East Suffolk and North Essex NHS Foundation Trust said it had begun an urgent investigation, secured the records and reported the matter to the Information Commissioner’s Office (ICO). The Trust also apologised to Noah’s family for the additional anguish caused at an already devastating time. We refer to the circumstances only to explain the wider data protection issues raised, whilst respecting the family’s tragic loss and privacy.

Can any employee access personal data held by their organisation?

No. Having technical access to a system does not give an employee permission to look at every record on it. An employee should access personal data only where they are authorised to do so and genuinely need it for their role. In a healthcare setting, for example, a member of staff would normally need a legitimate clinical or administrative reason to view a patient’s record.

Why can unauthorised access be unlawful?

Opening and viewing a record is “processing” personal data. Under the UK GDPR, processing must be lawful, fair and transparent; limited to a specified purpose; and be no more than is necessary. Organisations must also protect information against unauthorised or unlawful access by using appropriate technical and organisational safeguards. The ICO’s guide to the data protection principles explains these duties, while its access-control guidance recommends role-based permissions, limits for sensitive information and regular audits.

Medical information is “special category data”, which receives extra protection because misuse can have particularly serious effects. The organisation needs both a lawful basis for processing and an additional condition for handling this type of data. Personal curiosity, gossip or interest in a high-profile event will not normally provide either.

What can happen to an employee who accesses records without a proper reason?

The consequences depend on the facts, but may include an internal investigation, suspension, disciplinary action or dismissal. A regulated professional may also be referred to their professional body. NHS England has said that unauthorised access is harmful, damages trust and may lead to disciplinary action, dismissal, referral to a regulator and criminal prosecution; its current guidance is available here.

In some circumstances, the individual employee may commit an offence under section 170 of the Data Protection Act 2018 by knowingly or recklessly obtaining or disclosing personal data without the controller’s consent, subject to limited statutory defences. Whether an offence has been committed is always fact-specific.

What are the consequences for the organisation?

An employer is not automatically excused simply because a member of staff acted improperly. The organisation must be able to show that it used appropriate safeguards, such as proportionate access rights, staff training, confidentiality rules, monitoring, audit logs and a prompt response to suspicious activity. A failure in those arrangements may itself breach the UK GDPR. The organisation may also face complaints, reputational damage and civil claims.

The organisation must assess the risk created by the incident. If the breach is likely to risk people’s rights and freedoms, it should notify the ICO without undue delay and, where feasible, within 72 hours. If the risk is high, affected people must also be told without undue delay. The ICO’s personal data breach guide explains these duties. The ICO may investigate and use powers including warnings, reprimands, enforcement notices and financial penalties. Depending on the provision breached, the statutory maximum can reach £17.5 million or 4% of worldwide annual turnover, whichever is higher, although the actual outcome will depend on the seriousness and circumstances of the case.

Can the affected individual claim compensation?

Potentially, yes. Article 82 of the UK GDPR and section 168 of the Data Protection Act 2018 allow a person to seek compensation where a breach has caused material damage, such as financial loss, or non-material damage, such as distress. A breach does not automatically produce an award: the person must show an infringement, actual damage and a causal link between the two.

A claim can sometimes be settled directly with the organisation. If no agreement is reached, the court can decide liability and the amount of compensation. The ICO can investigate and take regulatory action, but it cannot award compensation.

How is data breach compensation calculated?

There is no fixed tariff for an unauthorised data access claim. The court looks at the evidence and the effect on the particular person. Relevant factors may include:

• What information was accessed: health, financial, identity, safeguarding and other sensitive information may cause greater concern than routine contact details;
• How much was accessed and for how long: one brief viewing may be treated differently from repeated access across a detailed record;
• What happened next: the court may consider whether information was disclosed, copied or misused and whether there remains a risk of further use;
• The person’s actual experience: worry, loss of sleep, embarrassment, fear of disclosure and medically recognised psychological harm may all be relevant if supported by evidence;
• Financial effects: proven losses and reasonable costs caused by the breach may be recoverable; and
• The organisation’s response: delay, poor communication or inadequate containment may affect the impact of the incident, although compensation remains focused on the damage caused.

Useful evidence may include the breach notification, correspondence with the organisation, a timeline of events, notes describing how the incident affected daily life, medical evidence where appropriate and proof of any financial loss. Awards are fact-sensitive, so headline figures from unrelated cases can be misleading.

A note about records following a death: the UK GDPR protects information relating to living individuals. It does not generally apply to a deceased person’s data. Other duties and causes of action may still be relevant, including the continuing duty of medical confidentiality and, depending on the facts, rights arising from information about living family members. Specialist advice is important because the legal route may differ.

What should you do if you suspect someone has accessed your records?

1. Ask the organisation what happened. Request the dates and times of access, the categories of information viewed, the roles of those involved, whether anything was shared and the steps taken to contain the breach.
2. Preserve evidence. Keep letters, emails, screenshots, expense records and a contemporaneous note of any distress or practical consequences.
3. Make a data protection complaint. Complain to the organisation’s data protection officer or privacy team. If the response is unsatisfactory, you can complain to the ICO.
4. Consider a subject access request. This may help you obtain personal data about the investigation, although exemptions and third-party rights can limit what must be disclosed.
5. Take legal advice promptly. Time limits and the correct defendant can be complicated, particularly where medical confidentiality or information concerning a deceased person is involved.

How Nelsons can help

If you believe your personal information has been accessed without a proper reason, early advice can help establish what data was involved, whether the organisation’s safeguards were adequate and what evidence is needed to support a complaint or compensation claim. Alternatively, if you are concerned that your company or organisation may have breached its obligations, early advice on how to tackle the issue can be vital and make the difference between avoiding a financial penalty from the ICO or not. Nelsons’ specialist privacy and data protection solicitors can advise on your options and the most proportionate next step.