A practice in the Brighton and Hove area

3. Ms G complains the Practice revealed historical personal and sensitive information inappropriately to a fostering agency. She says:

• some of the information was not relevant and some of it was incorrect • the Practice should have shared the information with her first and got her consent before sending it to the fostering agency • the Practice has not taken responsibility for its mistake.

4. Ms G says the experience was stressful and distressing for her and her family. She says it caused her and her elderly parents to have to revisit some difficult issues from when she was a teenager. Ms G is upset because her colleagues at the agency now know personal information about her.

5. Ms G would like a full explanation of how mistakes were made. She would like the individuals who shared her information to apologise. She would like a payment of £1,000 to £5,000 for the stress and distress. Ms G would like flags placed on her records that would be triggered by similar requests in future. She would also like her childhood records to be protected so they cannot be accessed except by a clinician who will be responsible for how the information is used.

7. The law says we cannot investigate a complaint where a person has (or had) the option to take legal action, unless we consider this is (or was) unreasonable in the circumstances.

8. We have discussed this with Ms G to understand her circumstances and the outcomes she wants. We do not consider whether legal action would succeed but whether it would be a reasonable option to look in to.

9. Ms G’s complaint is that the Practice gave inappropriate personal information from her childhood to a third party, without her consent. Ms G would like a payment of between £1,000 and £5,000 for the stress and distress. This is the main outcome she wants.

10. We have seen the Practice accepts it did not have consent to twice give the agency information. It has apologised for not checking she consented and for not copying her into the information that was sent. The Practice reported itself to the Information Commissioners Office (ICO) and listed what happened as a significant event to be investigated. It will discuss its investigation with the wider team at the Practice.

11. There are at least two causes of action (legal options) that Ms G could take through legal action. Both of which, if successful, may result in compensation being recommended. These are ‘data breach’ under the Data Protection Act 2018 (the DPA) and ‘breach of confidence’. Because of this, we can see Ms G has a legal route available to her.

12. Legal action would mean taking an issue to court and a court looks at financial payments differently to us. Generally, a court can recommend higher amounts of payment than we can. We think it is reasonable for Ms G to explore her legal options to get the outcome she is looking for. She has not told us about anything that would stop her from taking legal action.

13. We know Ms G also wants a personal apology and improvements to the Practice’s service. While legal action does not directly provide these, they can be achieved as a by-product of any action. Ms G is aware of this.

14. We understand how distressing it was when her personal information as a young person was shared with a third party and we thank her for bringing her complaint to us.

1. We have carefully considered Ms G’s complaint about a GP practice in the Brighton and Hove area (the Practice). We consider Ms G could take legal action on the matter she has brought to us. For this reason, we will not continue our investigation. We explain the reasons for our decision below.

2. We understand how upsetting it was to find that medical records from her past had been shared with a third party, without her consent.