Manchester University NHS Foundation Trust breach employee’s data

Background

Mr Matthew McConville, the Head of our specialised Data Breach Department at Irvings Law has successfully represented a client in a data breach compensation claim. The said client wishes herself to be unnamed for the purposes of this case report and as such will be referred to as ‘Miss B’ whereas Manchester University NHS Foundation Trust will be names as just ‘the Trust’.

Miss B was, during the course of her employment with the Trust, subject to a disciplinary investigation alleging that she had retrospectively amended a patient record without following proper procedure and potentially to cover up a mistake that she had made in practice. The allegations were ultimately dismissed with no sanction following a full investigation at a disciplinary hearing and she subsequently left the employment of her own accord.

During the course of the investigation, the Trust sent two emails to an incorrect third party email address. The Trust notified Miss B in a meeting of the error and also in a letter, but Miss B did not know who the recipient was, the contents of the emails or when the emails were sent. Miss B has subsequently discovered what was contained within those two emails.

An email attaching a letter intended for Miss B headed “Private and Confidential” along with terms of reference also marked “Private and Confidential” was sent to an incorrect third party email address. The letter contains the following paragraph:-

“Please note the importance of confidentiality with regard to this matter.   You should not discuss this issue with any colleagues in the Trust….any breach of confidentiality may result in disciplinary action being taken”

The terms of reference contained the following paragraph :-

“All parties will be reminded of the strict requirement for confidentiality regarding the investigation and will be advised that any breach of confidentiality may be dealt with under the Trust’s disciplinary policy and procedure.”

The email and the attachments contained details of Miss B’s personal data including

1. Her name
2. Her address
3. The allegation of misconduct again her
4. The basis of the investigation
5. Where and when her investigation interview would take place and who would be in attendance.
6. That she had been suspended
7. Details of the Commissioning Manager, Investigation Officer, HR support and Trade Union Representative Personnel.

A further email containing a letter to Miss B headed “Private and Confidential” which attached copies of the notes taken from the aforementioned investigation interview was also sent to an incorrect third party email address. The letter contains the following paragraph:-

“This investigation will be dealt with in the strictest confidence and any breaches of confidentiality by any participants involved in the investigative process will be addressed through the Trust Disciplinary Policy and Procedure.”

The investigation notes contain a reminder to all participants of the need for confidentially which was ticked. The email and attachments contained details of Miss B’s personal data including:-

1. Her name
2. Her Address
3. When she qualified and where she had trained
4. Where she worked; on which ward and the duration of her employment
5. Her knowledge and work practices
6. Why she amended documentation that formed the subject of the investigation against her
7. Her mental health state and that she had been order the care of a psychologist following the incident
8. Her mentorship support

The Trust received a response from the said third party saying “Hello, not sure who this email is intended for but you have an incorrect email address, regards”. It was Miss B’s contention that this email notifying the Trust that they had sent the email to incorrect address was received before they had erroneously sent the second email referred to above. The Trust received a second response to the Assistant HR Business Partner saying “As previously you have an incorrect email address…… surely under GDPR personal details should not be shared.”

After this, Miss B raised a complaint with the Trust and by way of a response, the Trust unequivocally admitted that they had breached the Data Protections Legislation saying under the heading “Breach of Personal Data”.

“I would like to assure you that this breach of confidentially is unacceptable and has been taken very seriously.   The breach has been recorded on the Trusts Incidents Reporting System in line with the Data Protection Legislation and a full investigation has been undertaken so that lessons can be learned and corrective actions put in place to avoid a potential future re-occurrence.”

Representation

As the Trust had done this, Miss B sought assistance from Mr McConville. Without hesitation, Mr McConville offered to act for Miss B on a no win no fee basis and once instructed, Mr McConville submitted a Letter of Claim to the Trust alleging that they had not kept Miss B’s sensitive information safe and secure, they had breached / invaded her privacy under the Human Rights Act, had breached the Data Protection Act 2018/the General Data Protection Regulation (GDPR) as well as confidence following their misuse of private information pertaining to Miss B.

Outside the prescribed time-frame for a response under the applicable pre-action protocol, the Trust formally admitted liability for breach of their stipulated duty. However, before they did respond and because they did not act in accordance with the rules, Mr McConville issued High Court proceedings against the Trust.

Resolution

Following doing this, the Trust insisted upon settlement discussions with Mr McConville and Miss B. Originally, the Trust made a low settlement offer to Miss B inclusive of her legal costs. However, after negotiation and in accordance with Miss B’s instructions to resolve the matter without involving the Court any further, settlement was reached in the sum of £4,000.00 plus Miss B’s legal costs.