Any GDPR experts able to help me out?

[GDPRhelp]

I've name changed as this is outing.

I was at my GP for a nurses appointment last year, it was just a vaccination and the door was open. I mentioned to the nurse that I'd really struggled to get an appointment recently and had accessed a private GP. The nurse shouted to a lady in the corridor to come in. She introduced herself as a manager and asked why I had gone private. I gave my reasons and she gave me quite a hard time about going private, said no one else has an issue queuing up or getting an appointment. She was stood over me and I felt quite intimidated. We were getting nowhere with the discussion and I said I had to leave.

That was last year.

Cut to last week on our local Facebook group someone commented how the GP practice had gone downhill. Over 90 people commented to say it was a bad service. I commented warning people to be careful what they say as when I had complained the manager had interrupted my appointment to give me a hard time. I mentioned no names, I wasn't rude and was completely factual.

Last night I went to the walk in centre (no appointments at GP!) and have been referred for diagnostic tests.

Today phone rings and I thought it's the doc wanting to speak about my tests but no - it's the manager wishing to "discuss" my post on social media. Again she was very intimidating, misquoted me, spoke aggressively and constantly spoke over me in a raised voice.

What is the GDPR perspective on this? Is she allowed to dip into my data to obtain my number and call to give me a bollocking?

If it was a public post on Facebook, there’s no gdpr reason why she shouldn’t look at it. But her attitude stinks obviously.

It's not that she shouldn't have looked but that she shouldn't have used her position to obtain my contact details and call me to give me a hard time.

She can look at your public postings, but she is breach of GDPR in using the records for personal reasons, ie calling you about a personal dispute. A serious complaint is required.

They have your contact details in so that they can provide GP services to you. That would include administering complaints or following up on issues you have raised. I don't think use of your data is the issue here but their customer service does not sound great.

Sorry ignore above. I misread and thought the post was on the surgery facebook page - not a personal one.

Is she the practice manager? Within the NHS any and all staff must have a valid reason for accessing a patients file as it can be traced.
GDPR would be an issue if she/they had shared your personal information or not kept it secure.
I.M.H.O this is more about poor professional conduct, bad customer service in breach of the NHS Constitution;

You have the right to privacy and confidentiality and to expect the NHS to keep your confidential information safe and secure.
You have the right to be informed about how your information is used.
You have the right to request that your confidential information is not used beyond your own care and treatment and to have your objections considered, and where your wishes cannot be followed, to be told the reasons including the legal basis

You have the right to complain.
cant get the bold to work!

Thanks for everyone's responses so far. I'm not exactly a melt but I was quite shaken, I think because I was expecting news about my tests and I got a row instead!

She's the business manager, rather than practice manager. I can't think of a single reason why she should be legitimately accessing my data to cold call me.

Yes I'd complain to the practice manager. She accessed information given for medical purposes to harass you about your social media. She also behaved unprofessionally to you.

I'd ask them to confirm she will not be permitted to access your records or contact you again and remind them they should have dobbed themselves in to the ICO. Ask them to confirm they have done so failing which you will.

I don't actually think you have grounds to complain. You were the one using social media to bring the practice into disrepute & she called you to discuss it. GDPR covers social media, but you are the one in the wrong I think. Her call to you is covered by legitimate interest.

Is your phone number available for public to view on your social media settings? I have mine set to private so no one can see it - some friends have their email/phone number visible on their profiles?

I’d check that before making a GDPR complaint - but I would be complaining about their conduct

I think it is probably OK as well. She didn't cold call you. She rang to follow up on a complaint you had made publicly.

Clearly you can say what you like where you like but I should think they can cease your registration if you are a malicious complainant.

Its not a GDPR matter.

The surgery have your data in order to administer a service, e.g. GP health services therefore they are processing your information lawfully.

Part of the administration of a service includes the ability to deal with complaints that are made. You raised a complaint, they contacted you to deal with it.

I don’t think there is anything to suggest op made a malicious complaint. I agree that it seems she is not using the data held by the practice for a proper purpose (sorry I misunderstood your question). It’s pretty nuts her behavior and I can see why you are upset. I think probably there are better avenues to follow for complaints than gdpr but you could include that as her behavior sounds entirely unacceptable.

This was a personal issue and she is not entitled to access patient data in order to harangue you. If you had made a complaint to the surgery then yes. She could have obtained your details. Make a complaint.

Thanks everyone for responding.

If I'd made a complaint on social media I could sort of understand it. However my comment on social media was warning the others who were complaining to be careful what they were saying - as she had previously interrupted my appointment to harangue me... and then she did it again!

She actually said she didn't want me to think her behaviour at the appointment was typical of how she conducts herself... so why repeat the exact same behaviour only on the phone?

She had no legitimate interest to be accessing your personal data in that way.

Complain.

Get advice from the ICO.

The surgery and therefore the practice manager as the person designated to deal with complaint in behalf of the surgery has a legitimate interest and additionally almost certainly consent to process data for the purpose of responding to a complaint which is part of the provision of a service.

This is not a a personal matter. The OP complained about the practice managers behaviour in the course of her role. The business are responding to that complaint.

If the OP had complained about the way the practice manager had yelled at her in the supermarket that would be a personal matter.

I agree with Scifi there is no legitimate interest for the business manger to access patient records

I agree there is no legitimate interest. The comment was made on a private FB page not the surgery one. LI has got to be balanced against the individuals rights/expectation. If you make a post on a local FB group as opposed to the surgery page you would not expect a phone call from the business manager to follow this up.

I'd post again to wind her up even more, explaining what she's done now.

But then I'm like that.

It’s a huge breach of your personal details. Definitely complain

I'd complain to them and ICO

If you make a complaint on a public community website then you have no right to expect that it won't be seen by organisations that are members of the community.

OP did you consent to the processing of your data and what does the Privacy Notice say in relation to how your data is processed?

So much poor advice on GDPR

OP I would suggest you post on legal if you want actual advice rather than you're just ranting

This most likely IS a gdpr breach - she can only contact you on the details the surgery has for matters you have specifically consented for contact about (which likely was described as, appointments test results etc)

You did not complain to the practice directly and ask for a response from them so she has no excuse there.

However you will need to check what agreements you actually made with the GP when they asked for gdpr consent.

Facebook comments can be annoying, but she has been unprofessional. I would report her.