Solicitor suggestion/Terrible disclosure

[aaron1867]

Not going to give the very long story, but need some suggestions on any potential solicitor for something that has got to me for a bit.

A public business (Business A) had some of my health details, which in reality they didn't need to know but somehow knew anyway. Sadly the health issue I have is completely private to me. However they went for some unknown reason to disclose it to another business. There was simply no reason to do this & also no consent from me, in which I turned up to talk to Business A to be told that they had told Business B.

I'm obviously infuriated that this has happened really. I have since spoke with Business A who have done their investigations into it & they have sent me a letter confirming that this has been disclosed without consent. I have also since met up with them to discuss the outcome, an outcome which we haven't agreed upon.

I am now completely infuriated by all of it, because they seem to think it's nothing, whilst I am of the opinion that it's something that should be dealt with much harsher,

If i see a solicitor, what can they do? Have I case for court? What solicitor suggestion if anyone has one (I live in Sheffield).

Cheers.

[doubleup]

Unauthorised disclosure of sensitive personal information is a criminal offence, you should report the issue to the Information Commissioner.

[mulhuzz]

what remedy are you looking for?

also, some disclosures are 'allowed' without patient consent, although *usually* those would be disclosures made by a healthcare professional and are all certainly proscribed in a detailed manner by the law, so since it appears company A admits fault, this probably isn't the case here.

There may be a criminal offence under the DPA committed but more likely you can ask the ICO (Information Commissioner's Office) to investigate. There may be other 'court' remedies available to you - it really depends on the exact circumstances e.g. if you could show A acted maliciously or negligently.

A good lawyer should be able to tell you within ten minutes in which direction it's worth pursuing, if at all.

[aaron1867]

Unauthorised disclosure of sensitive personal information is a criminal offence, you should report the issue to the Information Commissioner.

ty, will look into this

what remedy are you looking for?

also, some disclosures are 'allowed' without patient consent, although *usually* those would be disclosures made by a healthcare professional and are all certainly proscribed in a detailed manner by the law, so since it appears company A admits fault, this probably isn't the case here.

There may be a criminal offence under the DPA committed but more likely you can ask the ICO (Information Commissioner's Office) to investigate. There may be other 'court' remedies available to you - it really depends on the exact circumstances e.g. if you could show A acted maliciously or negligently.

A good lawyer should be able to tell you within ten minutes in which direction it's worth pursuing, if at all.

I have asked myself what response I wanted from this many times, but I still don't really know. After I spoke with a manager in person about this issue I outlined to them what I did want to see happen, however after them writing back to me with what they are going to do, it just isn't what I wanted. So I feel as if I have to take it to court.

People have said to me "we're human we make mistakes" - But is this just a mistake? It doesn't seem so to me. He knew of the medical issue, he never asked, but instead even before I met this bloke he had disclosed details to Business B. I turned up to meeting him and him saying "I have told xxx that you have xxx". I can understand that potentially Business B may want to know about this, but it's not really relevant and if he did ask, it would have never been an issue.

I am just of the opinion that now Business A has admitted that there was been no consent from me, that it clearly shows there is a case to be answered.

At this point, I am not sure which solicitors are best to potentially use.

[RED-DOG]

I really do sympathise. I would be mortified if something like this happened to me.

That being said, I can't help thinking it would be great if you could find a lawyer called Solicitor C.

[mulhuzz]

tbh, I don't even think you have to show that you never gave A consent to disclose. I think it's enough that there's a general duty to protect private information. What reason did A give for the disclosure to B? Can you think of 'some good faith reason', or was it totally irrelevant?

I for sure would also be furious about something like this btw, but if you look at it from their side, can you see any objective good reason for disclosure?

In your case, I'd start by approaching a CAB btw - they will be able to advise you quite simply if it's worth engaging a solicitor. I also wouldn't go down the solicitor route without knowing what I wanted to achieve, so CAB can prob tell you what is 'achievable' and then you can decide if you'd even be happy with that as an outcome.

In any event, if you complain to the ICO at best they'll get a warning/fine depending on their circumstances and their record as a data controller. Honestly, I think it's pretty unlikely you'll find a better mechanism than an ICO complaint to deal with this, though. And you can likely do that yourself, without engaging a solicitor.

[tikay]

ICO or Data Protection Act are the best vehicles.

It sounds like a clear breach of the DPA.

Essentially, the DPA says "you may only use info for the purpose it was given, & you must take care not share it with others outside of that purpose".

 

[The Wycher]

As has been mentioned this appears to be a breach of the DPA and should be reported. In terms of solicitors you would be best I suspect to go to larger firm, who may have specialists in this area. The larger firms may also offer a free consultation to see if there is anything they can do, just make sure you confirm this in advance and how long the free meeting is.

One issue is has there been a financial loss (i.e. did you not get work etc from B which you may have got if this was not disclosed), if so then a claim may well be relevant.  The issue with this is that if it goes to court the information will potentially be in the public domain.

Have you had assurances from both businesses that this information will not be passed on to anyone else.

[aaron1867]

The health information is simply not relevant to either business to be quite honest. But we all know people that have been given information that they shouldn't pass on, but can't help themselves. I'm lucky enough to be 100% confident that the manager of B would have kept this to herself. But this is information that is completely private to an individual and they are also a public services business too, which should know better.

[George2Loose]

I'd try and get a settlement if I were u or go to the regulatory body. A solicitor will just bleed u dry.

[aaron1867]

I'd try and get a settlement if I were u or go to the regulatory body. A solicitor will just bleed u dry.

This is the route I'm now likely to go down. They've admitted their guilt in a level one complaint and also received a letter of apology with their plans to "improve".

The complaint is now level 2 and in awaiting their response, but what is a reasonable settlement in this situation? They've disclosed private and confidential information and I've had a long time worrying about it.

Taking them through the courts must surely cost them £10k+ too

[OverTheBorder]

I'd try and get a settlement if I were u or go to the regulatory body. A solicitor will just bleed u dry.

This is the route I'm now likely to go down. They've admitted their guilt in a level one complaint and also received a letter of apology with their plans to "improve".

The complaint is now level 2 and in awaiting their response, but what is a reasonable settlement in this situation? They've disclosed private and confidential information and I've had a long time worrying about it.

Taking them through the courts must surely cost them £10k+ too

I would be surprised if you got more than £500 for distress and inconvenience, without financial loss that's the only ball park your in. ICO can arrange fines but they don't go to the victims. Doubt the courts would entertain it without deemed loss.

Horrible situation though, the most private of data should be handled with upmost care.

[sovietsong]

Is it just me wondering what the details are?

Might give business A a call.

[Kmac84]

Is it just me wondering what the details are?

[aaron1867]

Is it just me wondering what the details are?

lol - I understand people are nosy, but the whole point is that this is something completely private to me and it was disclosed.

I have for quite a bit kept meaning to go to CAB before wasting money on a solicitor, but not really found the time & still stuck for my next move.

I have sent them a letter, they've sent another, they've investigated, I've asked for it to be raised, they've investigated and that it what has happened so far.

However today's later is from Level 2 complaints team in which they have admitted full guilt once more. They have said they have also been to the IC and they have said it's a clear breach of the DPA. However the letter goes on to say that they would like to halt any action within their business and to deal with it as a breach of data protection.

I have no idea what that means really. So if anyone has any advice that'd be great or I really must get down to CAB this week!