Unlawful accessing of medical records leads to hospital's compensation payout

The judge said the unlawful access and subsequent handling of the man's complaint had exacerbated his pre-existing medical condition and entitled the man to compensation under the DPA, according to a blog post by the barrister acting for the man.

Under section 13 of the DPA a person is generally entitled to compensation if they suffer damage as a result of violations of a section of the DPA by organisations that hold their personal data. Individuals are also generally entitled to compensation from those data controllers if they suffer distress that causes damage.

Under the DPA a person is generally guilty of an offence if they "knowingly or recklessly ... obtain or disclose personal data or the information contained in personal data, or procure the disclosure to another person of the information contained in personal data" without consent from the 'data controller'.

Organisations must take "appropriate technical and organisational measures ... against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data", according to the Act. Extra protection must be provided to sensitive personal data, which the Act defines that relating to an individual's "physical or mental health or condition".

Because information about such matters could be used in a discriminatory way, and is likely to be of a private nature, it must be treated with greater care than other personal data, the ICO has said in guidance on sensitive personal data.

Sean Grinyer had a pre-existing paranoid personality disorder which was made worse when his partner at the time – a nurse at Plymouth Hospital NHS Trust – unlawfully accessed his medical records, the judge had determined, according to a blog by information law experts Amberhawk Training.

That violation of the DPA, and subsequent handling of Grinyer's complaint about the incident, aggravated Grinyer's medical condition and constituted a personal injury from which Grinyer was entitled to compensation, the judge ruled.

Grinyer was also awarded £4,800 for loss of earnings after the judge determined that the exacerbation of his condition had caused him to refuse the offer of work, according to the blog.

"This is a very interesting case because successful claims for compensation under section 13 of the DPA are few and far between," Kathryn Wynn, data protection law expert at Pinsent Masons, the law firm behind Out-Law.com, said.

"Up until now, typically, cases have been brought by celebrities as part of often successful wider cases regarding infringements of privacy or by individuals complaining about failure to respond to a subject access request, which are rarely successful and are usually part of a wider campaign against the defendant," Wynn said.

"This case has been brought by an ordinary man in the street in relation to an unlawful disclosure in relation to an isolated incident. It is also the first time that an award for loss of earnings has been made," said Wynn. "The amount awarded now sets a benchmark for the level of compensation that could potentially be awarded."

"This would certainly give claimants a stronger negotiating position in terms of any settlement agreement proposed. However, now that guidance has been provided on the sort of claim that could be successful and the amounts involved, it may encourage some claimants to refuse settlement and to proceed to court. On the whole, I expect that we will start to see more cases reaching the courts," she said.