Active discussions

Please or to access all these features

Talk
AIBU?

Share your dilemmas and get honest opinions from other Mumsnetters.

Original poster

Data protection breach at drs surgery - compensation?

114 replies

peony90 · 07/05/2026 22:47

Hello

A few months ago, I was told by an acquaintance that a woman who she was friends with (who was in the year above me at school and in the same year as my Husband) had told her personal things on my medical record. She is a receptionist at the surgery I used to be at.

The acquaintance knew how many miscarriages I’d had (not a number you could just pluck out of nowhere), what medication I was taking and how I was hospitalised in a psychiatric unit and the woman in question called me a “psycho” and divulged highly sensitive information about an overdose I took after losing another pregnancy in 2021 as well as both of my parents unexpectedly.

This is being fully investigated and they’ve admitted and confirmed that there was a data protection breach (I’m guessing her staff log in was recorded as opening my medical records when she had no reason to) but I’m still waiting to hear of the full outcome.

I am devastated, embarrassed and upset and my aunt who works for the NHS has advised me to seek compensation once the investigation is completed.

I still suffer from anxiety and depression which is usually well controlled however since the birth of my 2nd DD 6 months ago, I have been suffering PND and this has really knocked me. My antidepressants have been put up to a higher dose and I’ve needed anti anxiety tablets for the first time since 2022.

What would you do?

Long term user, name changed.

OP posts:
New posts on this thread. Refresh page
DietStartsTuesday · 09/05/2026 09:03

This is a serious breach of GDPR, I would question how well equipped a doctors surgery is to deal with an investigation.

I would raise a complaint through the ICO (Information Commissioners Office - https://ico.org.uk/make-a-complaint/) as they will be able to investigate thoroughly. They can also fine /sanction the surgery if their systems to control data weren’t up to the required standards.

Imdunfer · 09/05/2026 08:51

peony90 · 09/05/2026 08:24

Thank you everyone for your responses.

My brain is a little fuzzy right now, is anyone able to tell me why it’s classed as a criminal offence? I’m so sickened by this and my anxiety is awful.

The GDPR l laws are clear that passing somebody's confidential personal information gained in the process of your work to a third party is a criminal offence.

At the very least this is gross misconduct and there is no way that person should be in her job for a minute after the offence came to light. Immediate suspension followed by dismissal without notice if the allegations are proved.

Personally I would want to see her in court. It really doesn't get much more serious a thing for a doctor's employee to have done than what has been done to you.

MorphandMindy · 09/05/2026 08:49

Do keep pressing. Remember the ICO is a regulator but does not award compensation, and you should see a solicitor who has experience with claims involving primary care.

Do not worry about "taking money from the NHS"; like any critical organisation staffed by mere humans where the risks and impacts of fucking up are extremely high, it has a defence fund and insurance for a reason. This is an obvious risk which should be mitigated by training and remediated with disciplinary consequences (you may not hear of this as it's between the employer and employee) and compensation and apology (this is between you and the organisation, but not you and the employee).

Snorerephron · 09/05/2026 08:39

RobinHumphries · 09/05/2026 08:38

You haven’t suffered any financial loss so as such are not entitled to any compensation

Nonsense. Why give advice like this when you clearly are completely ignorant about the legal system?

Compensation can be paid to compensate for all sorts of harm.

RobinHumphries · 09/05/2026 08:38

You haven’t suffered any financial loss so as such are not entitled to any compensation

KeenSnail · 09/05/2026 08:34

I actually experienced a data breach last year from someone I knew accessing my medical records.

I was given a full breakdown of how many times they had read my records, for how long in minutes and seconds and also the specific pages they had accessed and read.

It took almost a year from when I was first notified formally by the NHS to receiving the full report, I had to keep chasing as they prolonged the deadlines they had given and eventually I had to threaten to raise a formal complaint before I actually received the final information.

In regards to compensation, you would have to speak to a legal team (a quick google will help.). All that I reached out to alluded that because it was an individual issue rather than a failure of security I wouldn’t receive any money and it was not worth it for them to take on my case.

I am at peace with it now knowing the person was dismissed and the stress of it ongoing in the background is over for me.

Sorry OP, absolutely horrible thing to have happened :(

ClockClocCloClC · 09/05/2026 08:32

Sorry my post above says your can’t get compensation for emotional distress - that should say you CAN get compensation for emotional distress.

Original poster
peony90 · 09/05/2026 08:24

Thank you everyone for your responses.

My brain is a little fuzzy right now, is anyone able to tell me why it’s classed as a criminal offence? I’m so sickened by this and my anxiety is awful.

OP posts:
ClockClocCloClC · 08/05/2026 20:58

You shouldn’t take this lying down OP, or be derailed by people (incorrectly) telling you that you can’t get compensation. What happened is completely awful.

You can’t get compensation for emotional distress. What happened is a criminal offence, and you should report it to the ICO. You should also, if you can afford it, get legal advice on your options regarding civil claims.

And don’t be put off by people talking about taking money from the NHS. It isn’t coming from the NHS, and even if it was it wouldn’t be a reason to take no action.

Imdunfer · 08/05/2026 20:36

vincettenoir · 08/05/2026 18:58

That’s positive. I assumed she will join a union (if not already in one) and am aware it’s very hard to sack people in the public sector after probation is complete. But it’s certainly easier on a security breach than on poor performance.

Show quote history

I'm going to repeat myself but this isn't just "a security breach" it's a criminal offence which should be gross misconduct and immediate dismissal.

She should be being taken to court, not just sacked.

Snorerephron · 08/05/2026 19:53

ScrambledEggs12 · 08/05/2026 19:12

This is not the topic of your AIBU, but I just wanted to say that I hope in time you can stop being so hard on yourself. It was the line about promising yourself that you wouldn't go back to that dark place.

For many of us mental health issues are for life. Sometimes there are good times, sometimes there are bad times. That doesn't change once we have children. It sounds like you've put in a lot of hard work in your recovery. But set backs are just part of the journey. Of course going back to your AIBU, this is a really crap situation and it's completely understandable that you feel like this. I hope that things improve for your mental health soon.

Show quote history

I agree with this too
@peony90 I was on the edge of inpatient admission with PND when my youngest was little. Take all the help you can. Try not to feel shame. Lots of us have been there. Since fighting back from PND I have loved everything about motherhood (well. Almost everything Grin. ).
Some of the most amazing people I know have mental health battles. It doesn't define them. And I hugely value their friendship and place in my life

ScrambledEggs12 · 08/05/2026 19:12

peony90 · 08/05/2026 00:21

I didn’t expect so many replies so quickly.

I’m not a grabby person at all and if I was to get any compensation, I’d split it 3 ways to charities close to my heart. Mind Charity, our local children’s hospice and Tommy’s.

I am lucky enough that we can afford a holiday once a year with our children, I do not need the money for a holiday and I’m not interested in buying myself anything. The children have savings accounts we pay in to. Our bills are up to date, we have food in the fridge and can turn the heating on when needed. I am aware that I am extremely lucky to be able to live like this when so many others cannot due to cost of living (we are not rich by any means and my DH works his butt off at our business to provide for us).

I may not have suffered financial loss but I’ve suffered a lot worse with my mental health since this all came out wondering how many people who know of me now think I’m a “psycho”, know that I went to a psychiatric hospital to get help because I didn’t want to be here anymore (before my children were born), know how many miscarriages I’ve had, she even told her that my DH and I had separated and it’s true we had. I’d spent months laying in bed, signed off work, rotting away, curtains shut and I refused to get help. He was exhausted by trying to help me when I didn’t help myself and I get why he left, I was killing his mental health too.

He supported me through my inpatient treatment and he was waiting with open arms when I left. We had marriage counselling and we were and still are better than ever.

We have since been blessed with 2 little miracles after almost 10 years of trying and miscarriages in the double figures with no medical explanation.

I’m currently battling PND and trying to keep my head above water with the help from my psychiatrist and this tipped me back over the edge. Somewhere I never want to be again. So whilst I did not experience a financial loss, I lost my grip of my anxiety and PND which is way worse, I promised myself I’d never go back to this dark place now that I’ve got children and here I am. How many others who know me or DH has she told this highly personal and sensitive information too?!

This is not the topic of your AIBU, but I just wanted to say that I hope in time you can stop being so hard on yourself. It was the line about promising yourself that you wouldn't go back to that dark place.

For many of us mental health issues are for life. Sometimes there are good times, sometimes there are bad times. That doesn't change once we have children. It sounds like you've put in a lot of hard work in your recovery. But set backs are just part of the journey. Of course going back to your AIBU, this is a really crap situation and it's completely understandable that you feel like this. I hope that things improve for your mental health soon.

vincettenoir · 08/05/2026 18:58

Snorerephron · 08/05/2026 18:00

@peony90 you absolutely shouldn't feel you have to give the compensation to charity. It's yours! To compensate you for the very real harm caused. You can spend it on something frivolous, or a holiday, or just savings.

I received compensation for an injury that will be with me for life. I used some for physio, some on a lovely holiday, and some to take a sabbatical from work to give me breathing space to recover and also make a plan to shift career direction

Don't let mealy mouthed people guilt you into feeling you have to give the money away. The fault lies entirely with the awful lady who gossiped

Totally agree with this.

vincettenoir · 08/05/2026 18:58

MycactusandI · 08/05/2026 17:46

No it's highly likely they will be sacked if proven that they were responsible. This is gross misconduct and taken very seriously.
Whether the practice can be held to blame for malicious behaviour of an employee is another matter. This is assuming they had been given information governance training and systems were password protected.

Show quote history

That’s positive. I assumed she will join a union (if not already in one) and am aware it’s very hard to sack people in the public sector after probation is complete. But it’s certainly easier on a security breach than on poor performance.

Snorerephron · 08/05/2026 18:00

@peony90 you absolutely shouldn't feel you have to give the compensation to charity. It's yours! To compensate you for the very real harm caused. You can spend it on something frivolous, or a holiday, or just savings.

I received compensation for an injury that will be with me for life. I used some for physio, some on a lovely holiday, and some to take a sabbatical from work to give me breathing space to recover and also make a plan to shift career direction

Don't let mealy mouthed people guilt you into feeling you have to give the money away. The fault lies entirely with the awful lady who gossiped

DressOrSkirt · 08/05/2026 17:57

peony90 · 08/05/2026 00:21

I didn’t expect so many replies so quickly.

I’m not a grabby person at all and if I was to get any compensation, I’d split it 3 ways to charities close to my heart. Mind Charity, our local children’s hospice and Tommy’s.

I am lucky enough that we can afford a holiday once a year with our children, I do not need the money for a holiday and I’m not interested in buying myself anything. The children have savings accounts we pay in to. Our bills are up to date, we have food in the fridge and can turn the heating on when needed. I am aware that I am extremely lucky to be able to live like this when so many others cannot due to cost of living (we are not rich by any means and my DH works his butt off at our business to provide for us).

I may not have suffered financial loss but I’ve suffered a lot worse with my mental health since this all came out wondering how many people who know of me now think I’m a “psycho”, know that I went to a psychiatric hospital to get help because I didn’t want to be here anymore (before my children were born), know how many miscarriages I’ve had, she even told her that my DH and I had separated and it’s true we had. I’d spent months laying in bed, signed off work, rotting away, curtains shut and I refused to get help. He was exhausted by trying to help me when I didn’t help myself and I get why he left, I was killing his mental health too.

He supported me through my inpatient treatment and he was waiting with open arms when I left. We had marriage counselling and we were and still are better than ever.

We have since been blessed with 2 little miracles after almost 10 years of trying and miscarriages in the double figures with no medical explanation.

I’m currently battling PND and trying to keep my head above water with the help from my psychiatrist and this tipped me back over the edge. Somewhere I never want to be again. So whilst I did not experience a financial loss, I lost my grip of my anxiety and PND which is way worse, I promised myself I’d never go back to this dark place now that I’ve got children and here I am. How many others who know me or DH has she told this highly personal and sensitive information too?!

If you do get compensation don't feel like you have to give it to charity.
You could use it for therapy to work through the extra anxiety this has caused, or anything else you need.

Snorerephron · 08/05/2026 17:49

pitchblackromance · 08/05/2026 13:58

I don't really have an opinion either way on if you should or shouldn't claim compensation. But one thing to think about is that making a claim will mean all of your mental health history is gone through and questioned, that can be alot for someone all struggling, don't make a decision just yet op, sit on it and decide what you could or couldn't cope with

Not necessarily, an astute GP surgery should offer a decent amount of compensation and not try and resist the claim where the breach has been proven and the harm is clear

Imdunfer · 08/05/2026 17:49

I wouldn't be looking for compensation myself though I understand why you would.

But this situation is utterly outrageous, and I would certainly be looking for the woman concerned to be prosecuted under the GDPR laws, she has committed a serious criminal offence.

Snorerephron · 08/05/2026 17:48

Please speak to a law firm that deals with data breach claims. There are plenty. They will probably be able to do a "no win no fee" arrangement for you.
Of course you should seek compensation that was incredibly private and sensitive information

MycactusandI · 08/05/2026 17:46

vincettenoir · 08/05/2026 10:14

If you remain dissatisfied after the Practice’s investigation (which you may not) you can complain to the ICO and then the Public Service Ombudsman.

In terms of what remedy would be available it would be primarily financial remedy. There are some very naive posters on here that don’t seem to realise that the NHS pay out billions in compensation each year. In terms of the person at the Surgery who leaked your information it is unlikely that they will be sacked although this kind of security breach is taken very seriously. You probably won’t find out how she will be impacted as that is her personal information.

Good luck. It seems to me that you are entitled to compensation and will likely be offered some but don’t get too emotionally sucked into the complaints process as it can take a lot out of people.

No it's highly likely they will be sacked if proven that they were responsible. This is gross misconduct and taken very seriously.
Whether the practice can be held to blame for malicious behaviour of an employee is another matter. This is assuming they had been given information governance training and systems were password protected.

Mcdhotchoc · 08/05/2026 14:58

I would. Im fact you should think about instructing a solicitor to make sure you are correctly compensated, given your mental health history.
It's disgraceful. I'd want to know how often they actually audit staff log ins vs the need to access records.

ohyesido · 08/05/2026 14:25

Have they sent you official response from the surgery’s Data Protection Officer?

vincettenoir · 08/05/2026 14:22

The above is not correct. It will be a paper-based exercise and you could have very little to do with it if you chose to. You can complain through the relevant regulators highlighted above. You wouldn’t need to go apply through the courts unless you chose to. The bigger problem is that it can take a long time which people generally find stressful. But you may be happy with the response from the GP practice without having to escalate in any case.

pitchblackromance · 08/05/2026 13:58

I don't really have an opinion either way on if you should or shouldn't claim compensation. But one thing to think about is that making a claim will mean all of your mental health history is gone through and questioned, that can be alot for someone all struggling, don't make a decision just yet op, sit on it and decide what you could or couldn't cope with