Tavistock & Portman NHS Foundation Trust ICO fine

The Information Commissioner’s Office (ICO) has issued a fine in the sum of £78,400 for a data breach involving the Tavistock and Portman NHS Foundation Trust.

This particular breach that involves a Gender Identity Clinic service is one we are already more than familiar with as we are representing people who were affected by the incident. Particularly personal and sensitive information has been leaked as a result of this email breach, so we are not surprised to see that regulatory action has also taken place.

Any ICO fine is a completely separate matter to those who are pursuing private compensation claims with us on a No Win, No Fee basis. We are coming close to the three-year anniversary of when the breach took place, which means that certain time-frames to join this action are coming to a close soon. You should speak to us as soon as possible if you have yet to claim as a victim of this incident.

About the Tavistock & Portman NHS Foundation Trust ICO fine

The ICO has announced that it has issued a fine to the Tavistock and Portman NHS Foundation Trust arising from bulk emails to almost 2,000 people in relation to a Gender Identity Clinic service. The amount of the fine has been set at £78,400.

The background to the matter is that in September 2019 an email was sent in two batches to 1,781 people relating to the GIC, and in both emails the addresses of the recipients were visible in the emails. This was a classic case of a mass email being sent out where the “To” / “CC” function is used instead of the “BCC” function. This archaic method of sending bulk emails should not be used at all, as there is plenty of readily available mass mailing software for organisations to use.

This is a matter we are already aware of as we are representing claimants who are engaged in compensation cases for the breach of their private information. Hopefully, lessons can be learned from this Tavistock & Portman NHS Foundation Trust incident to ensure there will be no repeat of this kind of breach again. This kind of data leak itself has happened on several occasions, with one of the most infamous preceding events being that of the 56 Dean Street Clinic leak where patients using HIV services suffered the same kind of breach.

A serious NHS data breach of 2019

This case was a serious NHS data breach in 2019, with the ICO findings into the Tavistock & Portman NHS Foundation Trust providing reasons for the outcome of its investigations.

Any NHS incident that results in the misuse and/or exposure of private information can be serious, as medical data is specifically the type of details that we want to be kept private. When it comes to users of a Gender Identity Clinic, this is clearly a particularly sensitive matter where anonymity and confidentiality are important. For this data breach to have occurred and have impacted on the service users is a serious incident which is why we are representing people claiming compensation.

Claiming compensation for an NHS data leak

Victims of an NHS data leak could be entitled to claim compensation for any distress that has been caused by the loss of control of personal information. If we consider that there is a case to answer, we may be able to represent you on a No Win, No Fee basis.

Our team is always happy to provide free, no-obligation legal advice and you can speak to them here now.

Public sector GDPR fines set to change

Phishing emails after data breaches