NHS trust criticised for data protection breaches after subject access requests

The Information Commissioner’s Office has criticised a health trust in Cornwall for disclosing third-party personal data on two occasions in 2010.

The watchdog’s head of enforcement, Sally-anne Poole, said: “More and more people today want to find out exactly what information their GP or hospital holds about them, making subject access requests an increasingly popular tool.

“However, just because staff are busy with requests, this does not mean they can stop doing adequate checks before information is sent out.”

The ICO said the Royal Cornwall Hospitals NHS Trust had breached the Data Protection Act in July and December last year.

On the first occasion, an individual had submitted a subject access request for information the trust held about them. In addition to sending the requested information, the trust send someone else’s information.

A further disclosure six months later also saw the requester – the same individual – receive third party information.

Royal Cornwall’s chief executive, Peter Colclough, has now signed an undertaking “to ensure that procedures for dealing with subject access requests are clearly defined and managed, and that all staff receive appropriate training and support in how to follow them”, the ICO said.