It's very rare that I post another blog, but this is a rare event indeed: a data subject has taken successful action for compensation under section 13 of the Data Protection Act. Normally what happens if a data controller has caused damage, there is an out-of-court settlement with a gagging (sorry “confidentiality”) clause so no-one is the wiser.
The claimant brought an action following an unauthorised disclosure of his personal medical data, in or about December 2007. The partner of the data subject had unlawfully accessed his medical records in the course of her employment as a nurse and thereby committed a breach of the Act. This and the handling of his resultant complaint caused a 4 ½ year exacerbation of a pre-existing paranoid personality disorder and prevented him also from accepting an offer of employment.
Honour Judge Cotter QC, sitting at Plymouth County Court, assessed damages for personal injury under s.13 of the Data Protection Act 1998. He awarded £12,500 was awarded for exacerbation of the Claimant’s pre-existing condition and £4,800 for loss of earnings on the premise that he had been offered 6 months work but in light of the medical evidence, viz that he would have been unable, probably, to sustain employment for any length of time, likely to have held a job down for only 8 weeks also.
A claim for aggravated damages failed
For a few more details of this unreported case (Sean Robert Grinyer v Plymouth Hospital NHS Trust; 28th October 2011) go to http://www.unitystreetchambers.com/blog/?p=131. But if anyone knows more, can you email me as Hawktalk would like to know.
Just out of curiosity, is this a fine which the NHS trust have had to pay or the nurse who "did the deed" as it were?
Posted by: Curious Guru | 05/12/2011 at 03:05 PM
The NHS Trust paid the compensation - it is not a fine
Posted by: cp | 05/12/2011 at 03:23 PM
Ok - thanks for the clarification.
Posted by: Curious Guru | 05/12/2011 at 03:45 PM