Is this GDPR breach?

[Starburst24]

This involves a dental surgery a whole family has used for 40 years

If your father had the same dentist as you, and he asked the receptionist when your last appointment was, would the dental practice be in breach of GDPR legislation by giving your father the details?

You don’t live with your father. He is in his 60’s, you are in your 40’s and not lived at the same address for 26 years

Yes

Yes! Why would he ask this info though?

Yes

@Elouera

Yes! Why would he ask this info though?

Because he’s an interfering test and can’t keep his nose out of my fucking business

I asked him how he found out, and his reply was
‘Because I’m your father’

I’m so pissed off and want to go fucking nuclear on the dental practice. I don’t give a fuck who he is, the receptionist had no right to disclose or discuss any of my private information

It's definitely a gdpr breach, and the fact he's a relation doesn't negate that. Go ballistic.

You are correct, definitely a breach. They are not even allowed to say that you are a patient as this is personal data.
I would complain even just to ensure they don’t do it again.

Awful.
They had no right to discuss your care with anyone else.

You need to be specific, what information did they tell him? The date of your last appointment? Anything else?

Yes. Sadly its unlikely you’ll get anything from reporting it; the ICO have been utterly toothless when it comes to smaller breaches, but you can definitely complain to the dentist.

I also have proof of this too as he sent me an email saying how long it had been since my last appointment. They can’t even deny it as I have it in black and white

It was probably just an accident. I would make a complaint in writing, hopefully they will explain how this was allowed to happen, apologise and retrain their staff.

@Twickerhun

You need to be specific, what information did they tell him? The date of your last appointment? Anything else?

He asked them when my last appointment was and he told me in an email when my last appointment was. I asked him how he knew as it was a breach of GDPR legislation and he replied ‘Because I’m your father’ Unsure if any other information was disclosed but that’s not the point. My anger is that they even disclosed ANY information to him

As Almostlegible said above, they shouldn’t even be confirming you are registered there, nevermind anything else!

I haven’t been to ‘that’ dentist in over 2 years

The first email from him was

‘You have not been for at least 2years’

I then asked how he knew
Further conversation was had and then I’ve just had this from him

‘As they do not have any records for you, not offence has been committed’

The fact he is your father is irrelevant to the legislation as you are not a minor.

It is a breech however in the grand scheme of things, your making a mountain out of a molehill. I'd advise the dentist surgery and suggest further training for the Receptionist. Who is probably young undertrained.

Well clearly they do have records for you - the date of your last appointment!

@AuditAngel

The fact he is your father is irrelevant to the legislation as you are not a minor.

If he said he was OP's father, without bothering to mention little things like ages, is it possible the receptionist didn't think to check OP's age? And assumed OP was a minor? Even if this was the case, receptionist should still get a rocket.

They shouldn't have told him but it's hardly top secret information is it. It isn't their fault your relationship is dysfunctional.

They do need reminding that they must not give this information out because even minor information can be damaging. I wouldn't go 'ballistic' though.

What do you actually want to achieve? If it's to ensure this doesn't happen again then a reasoned email is probably better than a rant. You also might want to give them details about why it's been a problem in this instance to clearly illustrate how something small can actually be serious.

It is a gdpr breach, yes. And whilst it may seem petty to some posters, there are some folk that will go to great lengths to find out information about others.

Take for example, an abusive ex who is trying to track down someone who has fled domestic abuse, court has ordered no contact. Uses the information to confirm that op is still registered at that dentist - therefore likely to be still living in the area. If receptionist says 'oh, op isn't registered here' then op could have moved. In this case OP's dad is somehow wielding the info that she's not been for 2 years in some sort of abusive(?!) power play that is making op anxious, and frankly is none of his bloody business!

There are myriad reasons why a seemingly innocent enquiry can lead to big problems with a gdpr breach. The receptionist needs retraining, make a complaint op.

Change Dentist and/or change Father.
Dad sounds like a total PITA!

I do agree with you @Ffsffsffsffsffs I'm just wary of which heads will roll in this situation if OP goes 'ballistic'. Learning why this is a problem would be ideal if possible.

It’s a breach and they should be informed so they can learn from it. No need for anyone to go ballistic but obviously explain what ever pain this caused you so they appreciate the consequences.

On the flip side, loads of family members phone dental practices on behalf of other members . Cancelling, checking, running late, can they swap appointments. The receptionist may have been caught off guard.

For perspective , I telephoned my husbands GP service about how to get some results ( he was sitting right next to me but their phone system does his head in ) to be told straight out his results by a very young sounding receptionist.

We didn’t go ballistic but she will have heard me lean over and say to my DH, “you’ve got Xxx apparently” in slightly amused tone.

His GP called him back within the next 20 mins.

Details of when your last appointment was are “ health information” which is actually a category of sensitive data ( ie should be even more well protected than email address, phone number etc). Go ballistic, your father’s update is incorrect.