Data Protection Breach - NHS

MarcMCFC1986

I wasn't sure which Forum to put this in, so just punted for this one!

This is a relatively long story, but I'll try to keep in concise...

I went to see my doctor in early 2013 about a condition I'd had since I was about 12, which was quite embarrassing for me, but admittedly I wasn't sick - it was more of a cosmetic thing. He said "We will do some blood tests and see if it can be rectified through medication, and if not we'll put you in for surgery!" Fast forward through 12-16 months of various blood tests which all came back as normal, so was referred to a surgeon who said he is happy to do the surgery, and I was booked in for a pre-op and for the actual operation. I went to my pre-op assessment which was 7 days before surgery, however 2-3 days before the surgery I got a call to say nobody had applied for funding, and so the surgery has been postponed until the funding has been approved. So I went back to my GP to apply for the funding, which he did, and it was rejected - we appealed and it was rejected again. I gutted as I was so close to having an issue which has caused me great embarrassment throughout my life rectified, only for it to be taken away at the last second - all because somebody hadn't done their job properly and applied for the funding (this should have been done by the GP).

I couldn't bear to be that close to having it done, so went to the bank and took out a loan for £4,000 and went private - and now I'm in the middle of a dispute with the NHS (which has so far gone on for 4 years) about trying to claim back the £4,000 which I spent on something which was promised to me by my GP.

Part of the complaints process is to have a meeting with the Patient Advice & Liaison Service (PALS) and the person I am complaining about - in this case the GP and Surgeon (as they were disputing whose responsibility it was to apply for funding, so both had to attend). I was asked whether I would like the meeting recording and sent to me so I have a record, which I accepted as I was keeping all records to build my case. I received this CD in the post about 2 weeks after the meeting, and just stored it with my other records.

I received a phone call from the NHS in February, to tell me that there has been a 'serious data protection breach' and that their copy of the recording (in which we discuss my condition and identify myself) has been sent to another patient by accident. Again, very unhappy with them and complained to the Information Commissioners Office (ICO) who confirmed that this is a data protection breach and that I am entitled to compensation.

I wrote to the NHS to complain about the breach, and was told that it would be investigated and they would come back to me with a response. Today I got an email from them offering me £500 compensation as, in their opinion, the breach was 'limited' as the recording was only sent to 1 other person, and was 'immediately retrieved' by a member of staff (the report they sent me says that they were made aware on the 11th of the month and somebody went to collect the recording on the 14th - so not 'immediate' in my opinion :think:)

Also, this happened in February, and on the 28th February somebody took out 3 payday loans in my name which has sent my credit down the toilet - it might be completely irrelevant, but it does fall nice in place with the data protection breach. And it does increase the damage caused by their data protection breach.

So, anyway - my question is: Given the circumstances, is £500 really a fair offer for a breach of the Data Protection Act? Or should I be telling them to shove it and take them to court?

k3lvc

MarcMCFC1986 wrote: »

Also, this happened in February, and on the 28th February somebody took out 3 payday loans in my name which has sent my credit down the toilet - it might be completely irrelevant, but it does fall nice in place with the data protection breach. And it does increase the damage caused by their data protection breach.

So, anyway - my question is: Given the circumstances, is £500 really a fair offer for a breach of the Data Protection Act? Or should I be telling them to shove it and take them to court?

What relevant data was there in the breach to allow someone to apply for a loan in your name ? Did they somehow include your passport/formal ID/bank details etc. You're going to struggle to prove that one (or even give any possibility of a link)

As for the £500 as a negotiator I'd be looking to link it into your funding agreement. I can't see NHS funding the full £4k that you chose to pay privately but if you wrapped all this up together you might get a settlement closer to the £4k - if you fight I'd not expect you to get much more than the £500 and your overall claim might be contested more fully

Comms69

More than fair, typical pay outs are around £250 for data breaches. Yes this would be higher due to it being of a medical nature, but that's it.


Also all the other stuff was totally irrelevant. You aren't owed £4,000 by the NHS.

paddyandstumpy

IMO cosmetic surgery shouldn't be available at the expense of the taxpayer, if it takes funding away from live saving treatments.

[Deleted User]

It's a very generous offer.

MarcMCFC1986

paddyandstumpy wrote: »

IMO cosmetic surgery shouldn't be available at the expense of the taxpayer, if it takes funding away from live saving treatments.

It shouldn’t have been promised to me then!

Comms69

MarcMCFC1986 wrote: »

It shouldn’t have been promised to me then!

You're absolutely right, it shouldn't have been!

MarcMCFC1986

Comms69 wrote: »

Also all the other stuff was totally irrelevant. You aren't owed £4,000 by the NHS.

I’d disagree that it was ‘totally’ irrelevant - it was to show that this wasn’t the first f**k up that I’ve had to deal with from the NHS...a system I have to pay into every month but when I want something back they fob me off!

sleepymans

You were able to fund the surgery......accept the minor amount for the data breach and then move on.

Comms69

MarcMCFC1986 wrote: »

I’d disagree that it was ‘totally’ irrelevant - it was to show that this wasn’t the first f**k up that I’ve had to deal with from the NHS...a system I have to pay into every month but when I want something back they fob me off!

OK...


1: it was totally irrelevant, it had nothing to do with a data breach. It was filling to gain sympathy - they wanted to do the procedure but the local commissioners refused to pay for it. It happens, deal with it.
2: You are offered a fair amount of compensation, what did you expect to get?
3: Oh please, how much do you think you pay into it... £40 a month? What do you think that pays for?

k3lvc

MarcMCFC1986 wrote: »

I’d disagree that it was ‘totally’ irrelevant - it was to show that this wasn’t the first f**k up that I’ve had to deal with from the NHS...a system I have to pay into every month but when I want something back they fob me off!

Welcome to life - whilst our NHS continues to be abused by those expecting non-critical care it will ever be so. You found the answer to get the level of service you felt you deserved but you could throw a whole load of time and energy towards attempting to recover this from NHS and end up with nothing