Damages for unauthorised access to medical records

A judge has awarded £12,500 to a man whose pre-existing personality disorder was exacerbated after his partner accessed his medical records and challenged him about his mental illness.

The woman obtained unauthorised access while employed as a nurse by Plymouth Hospital NHS Trust and it was against that organisation that the action was brought.  It appears that the woman discussed the man's private medical condition in front of his father and children.

The claim was for damages for breach of the Data Protection Act 1998 and was heard in the Plymouth County Court.  Section 13 of the Act permits recovery of compensation for damage or distress caused by a breach of the Act.  In addition to £12,500 damages for injury and distress, the man was awarded damages for loss of earnings - that claim was apparently based on medical evidence that he would at the time have been unable to hold down employment for a sustained period.  It does not appear that the claimant sued for misuse of private information or breach of confidence.

Having regard to the sensitivity of private medical information and in comparison with some of the settlements agreed in the phone hacking cases, the damages might be considered modest.  While many of the phone hacking cases involved sustained invasions of personal privacy, they do not generally seem to have involved unauthorised access to medical records.

The case is not reported, but brief details are in a blog on the claimant's counsel's website and the case has also been reported in the local press.