Active discussions

Meet the Other Phone. Flexible and made to last.

Meet the Other Phone.
Flexible and made to last.

Buy now

Please or to access all these features

Talk
AIBU?

Share your dilemmas and get honest opinions from other Mumsnetters.

Original poster

Data protection breach at drs surgery - compensation?

114 replies

peony90 · 07/05/2026 22:47

Hello

A few months ago, I was told by an acquaintance that a woman who she was friends with (who was in the year above me at school and in the same year as my Husband) had told her personal things on my medical record. She is a receptionist at the surgery I used to be at.

The acquaintance knew how many miscarriages I’d had (not a number you could just pluck out of nowhere), what medication I was taking and how I was hospitalised in a psychiatric unit and the woman in question called me a “psycho” and divulged highly sensitive information about an overdose I took after losing another pregnancy in 2021 as well as both of my parents unexpectedly.

This is being fully investigated and they’ve admitted and confirmed that there was a data protection breach (I’m guessing her staff log in was recorded as opening my medical records when she had no reason to) but I’m still waiting to hear of the full outcome.

I am devastated, embarrassed and upset and my aunt who works for the NHS has advised me to seek compensation once the investigation is completed.

I still suffer from anxiety and depression which is usually well controlled however since the birth of my 2nd DD 6 months ago, I have been suffering PND and this has really knocked me. My antidepressants have been put up to a higher dose and I’ve needed anti anxiety tablets for the first time since 2022.

What would you do?

Long term user, name changed.

OP posts:
vincettenoir · 08/05/2026 18:58

Snorerephron · 08/05/2026 18:00

@peony90 you absolutely shouldn't feel you have to give the compensation to charity. It's yours! To compensate you for the very real harm caused. You can spend it on something frivolous, or a holiday, or just savings.

I received compensation for an injury that will be with me for life. I used some for physio, some on a lovely holiday, and some to take a sabbatical from work to give me breathing space to recover and also make a plan to shift career direction

Don't let mealy mouthed people guilt you into feeling you have to give the money away. The fault lies entirely with the awful lady who gossiped

Totally agree with this.

ScrambledEggs12 · 08/05/2026 19:12

peony90 · 08/05/2026 00:21

I didn’t expect so many replies so quickly.

I’m not a grabby person at all and if I was to get any compensation, I’d split it 3 ways to charities close to my heart. Mind Charity, our local children’s hospice and Tommy’s.

I am lucky enough that we can afford a holiday once a year with our children, I do not need the money for a holiday and I’m not interested in buying myself anything. The children have savings accounts we pay in to. Our bills are up to date, we have food in the fridge and can turn the heating on when needed. I am aware that I am extremely lucky to be able to live like this when so many others cannot due to cost of living (we are not rich by any means and my DH works his butt off at our business to provide for us).

I may not have suffered financial loss but I’ve suffered a lot worse with my mental health since this all came out wondering how many people who know of me now think I’m a “psycho”, know that I went to a psychiatric hospital to get help because I didn’t want to be here anymore (before my children were born), know how many miscarriages I’ve had, she even told her that my DH and I had separated and it’s true we had. I’d spent months laying in bed, signed off work, rotting away, curtains shut and I refused to get help. He was exhausted by trying to help me when I didn’t help myself and I get why he left, I was killing his mental health too.

He supported me through my inpatient treatment and he was waiting with open arms when I left. We had marriage counselling and we were and still are better than ever.

We have since been blessed with 2 little miracles after almost 10 years of trying and miscarriages in the double figures with no medical explanation.

I’m currently battling PND and trying to keep my head above water with the help from my psychiatrist and this tipped me back over the edge. Somewhere I never want to be again. So whilst I did not experience a financial loss, I lost my grip of my anxiety and PND which is way worse, I promised myself I’d never go back to this dark place now that I’ve got children and here I am. How many others who know me or DH has she told this highly personal and sensitive information too?!

This is not the topic of your AIBU, but I just wanted to say that I hope in time you can stop being so hard on yourself. It was the line about promising yourself that you wouldn't go back to that dark place.

For many of us mental health issues are for life. Sometimes there are good times, sometimes there are bad times. That doesn't change once we have children. It sounds like you've put in a lot of hard work in your recovery. But set backs are just part of the journey. Of course going back to your AIBU, this is a really crap situation and it's completely understandable that you feel like this. I hope that things improve for your mental health soon.

Snorerephron · 08/05/2026 19:53

ScrambledEggs12 · 08/05/2026 19:12

This is not the topic of your AIBU, but I just wanted to say that I hope in time you can stop being so hard on yourself. It was the line about promising yourself that you wouldn't go back to that dark place.

For many of us mental health issues are for life. Sometimes there are good times, sometimes there are bad times. That doesn't change once we have children. It sounds like you've put in a lot of hard work in your recovery. But set backs are just part of the journey. Of course going back to your AIBU, this is a really crap situation and it's completely understandable that you feel like this. I hope that things improve for your mental health soon.

Show quote history

I agree with this too
@peony90 I was on the edge of inpatient admission with PND when my youngest was little. Take all the help you can. Try not to feel shame. Lots of us have been there. Since fighting back from PND I have loved everything about motherhood (well. Almost everything Grin. ).
Some of the most amazing people I know have mental health battles. It doesn't define them. And I hugely value their friendship and place in my life

Imdunfer · 08/05/2026 20:36

vincettenoir · 08/05/2026 18:58

That’s positive. I assumed she will join a union (if not already in one) and am aware it’s very hard to sack people in the public sector after probation is complete. But it’s certainly easier on a security breach than on poor performance.

Show quote history

I'm going to repeat myself but this isn't just "a security breach" it's a criminal offence which should be gross misconduct and immediate dismissal.

She should be being taken to court, not just sacked.

ClockClocCloClC · 08/05/2026 20:58

You shouldn’t take this lying down OP, or be derailed by people (incorrectly) telling you that you can’t get compensation. What happened is completely awful.

You can’t get compensation for emotional distress. What happened is a criminal offence, and you should report it to the ICO. You should also, if you can afford it, get legal advice on your options regarding civil claims.

And don’t be put off by people talking about taking money from the NHS. It isn’t coming from the NHS, and even if it was it wouldn’t be a reason to take no action.

Original poster
peony90 · 09/05/2026 08:24

Thank you everyone for your responses.

My brain is a little fuzzy right now, is anyone able to tell me why it’s classed as a criminal offence? I’m so sickened by this and my anxiety is awful.

OP posts:
ClockClocCloClC · 09/05/2026 08:32

Sorry my post above says your can’t get compensation for emotional distress - that should say you CAN get compensation for emotional distress.

KeenSnail · 09/05/2026 08:34

I actually experienced a data breach last year from someone I knew accessing my medical records.

I was given a full breakdown of how many times they had read my records, for how long in minutes and seconds and also the specific pages they had accessed and read.

It took almost a year from when I was first notified formally by the NHS to receiving the full report, I had to keep chasing as they prolonged the deadlines they had given and eventually I had to threaten to raise a formal complaint before I actually received the final information.

In regards to compensation, you would have to speak to a legal team (a quick google will help.). All that I reached out to alluded that because it was an individual issue rather than a failure of security I wouldn’t receive any money and it was not worth it for them to take on my case.

I am at peace with it now knowing the person was dismissed and the stress of it ongoing in the background is over for me.

Sorry OP, absolutely horrible thing to have happened :(

RobinHumphries · 09/05/2026 08:38

You haven’t suffered any financial loss so as such are not entitled to any compensation

Snorerephron · 09/05/2026 08:39

RobinHumphries · 09/05/2026 08:38

You haven’t suffered any financial loss so as such are not entitled to any compensation

Nonsense. Why give advice like this when you clearly are completely ignorant about the legal system?

Compensation can be paid to compensate for all sorts of harm.

MorphandMindy · 09/05/2026 08:49

Do keep pressing. Remember the ICO is a regulator but does not award compensation, and you should see a solicitor who has experience with claims involving primary care.

Do not worry about "taking money from the NHS"; like any critical organisation staffed by mere humans where the risks and impacts of fucking up are extremely high, it has a defence fund and insurance for a reason. This is an obvious risk which should be mitigated by training and remediated with disciplinary consequences (you may not hear of this as it's between the employer and employee) and compensation and apology (this is between you and the organisation, but not you and the employee).

Imdunfer · 09/05/2026 08:51

peony90 · 09/05/2026 08:24

Thank you everyone for your responses.

My brain is a little fuzzy right now, is anyone able to tell me why it’s classed as a criminal offence? I’m so sickened by this and my anxiety is awful.

The GDPR l laws are clear that passing somebody's confidential personal information gained in the process of your work to a third party is a criminal offence.

At the very least this is gross misconduct and there is no way that person should be in her job for a minute after the offence came to light. Immediate suspension followed by dismissal without notice if the allegations are proved.

Personally I would want to see her in court. It really doesn't get much more serious a thing for a doctor's employee to have done than what has been done to you.

DietStartsTuesday · 09/05/2026 09:03

This is a serious breach of GDPR, I would question how well equipped a doctors surgery is to deal with an investigation.

I would raise a complaint through the ICO (Information Commissioners Office - https://ico.org.uk/make-a-complaint/) as they will be able to investigate thoroughly. They can also fine /sanction the surgery if their systems to control data weren’t up to the required standards.

New posts on this thread. Refresh page