Another Admin Error for the NHS Breaches Data Protection

Background

Irvings law has successfully represented a client in a data breach compensation claim against the NHS Business Services Authority; the client wishes to remain anonymous for the purposes of this case report.

The said client, who was previously employed by the NHS, received correspondence advising that they had sent previous correspondence to the client but was returned as the address was strangely ‘unknown’. This correspondence also confirmed that unless the client responded to update their information, their pension payments would stop and it was then it was realised that, the NHS had incorrectly recorded the client’s previous address and had been sending their yearly P60’s to this said address since 2012.

The NHS assured the client they would update their address and that future P60’s would be sent to the correct address instead. However, understandably, the client was not satisfied with the response and as such submitted a complaint to the Information Commissioner’s Office who confirmed there had been a breach of their data. The client wanted to take things further than this though.

Representation

As such, the client sought specialist data protection advice on the matter from Irvings Law and proceeded to instruct Yvonne Dobson whom offered no win, no fee terms before then submitting a Letter of Claim to the NHS regarding their breach. Bizarrely, despite the ICO’s finding, the NHS decided to deny liability for the presented privacy breach claim on the basis that it was a one off incident because of a human error.

Resolution

Miss Dobson advised the client to continue their claim because it doesn’t matter under data protection law if a breach has occurred once, a thousand times or on purpose or by accident. After challenge by Miss Dobson to the NHS’ position, negotiations began which resulted in the NHS paying the client compensation, her legal costs as well as changing their mind in that they formally and eventually admit that they had breached the client’s  personal information and promised to implement data protection practices to try and avoid any reoccurrence.