Leak of medical information

This is now recognised as a distinct “tort” (civil legal wrong).  Liability is assessed on whether:-

(a)  The information was private – this will be based on whether the person to whom the information relates had a ‘reasonable expectation’ of privacy in relation to the information.  Consideration of a person’s right to respect for private and family life will determine whether there is such an expectation.  This will often be easy to determine when the material leaked concerns medical information.

(b)  Whether there has been an infringement of the person’s reasonable expectation of privacy.  This will be fact specific and, in many cases, it will be clear whether there was an infringement or not.  Where the disclosure is arguably in the public interest then it is likely that there will need to be a more rigorous assessment of the merits of the claim and this will include a balancing exercise with the right to freedom of expression.  A defendant may be able to defend an action if the information is already in the public domain.

The remedies available are an injunction to prohibit the dissemination and damages.  Damages are principally intended to compensate a claimant for the distress that the unauthorised disclosure has caused to the person concerned.

This is an equitable cause of action that was traditionally associated with the unauthorised leak of trade secrets.  The case of Coco v AN Clark Engineers Ltd [1969] RPC 41 sets out the three essential requirements that must be fulfilled to bring a claim under this cause of action:-

(a)  The information in respect of which relief is sought must have the necessary quality of confidence about it.  In other words, the information would not already be common knowledge or within the public domain;

(b)  The information must have been imparted in circumstances imparting an obligation of confidence.  The law in this area has developed to allow such an obligation to be inferred in a wide variety of situations (including personal confidences), where a contractual relationship does not exist. An obligation of confidence will, therefore, usually arise whenever a person receives information that he knows or ought to know is confidential.

(c)  There must be an unauthorised use/disclosure of that information.

If a claim for breach of confidence succeeds, the remedies which can be awarded include damages, an account of profits and/or an injunction.

Generally, companies and persons who process personal data will be ‘data controllers’ under data protection legislation.  The legislation imparts certain obligations on these controllers and they will need to register with the Information Commissioner’s Office (ICO).  The obligations include implementing proper procedures for the protection of personal data and to process that data in accordance with the principles set out in the GDPR.  If there has been a leak of medical information then this will often mean that there has been a breach of the GDPR and Data Protection Act 2018 (medical information nearly always being personal data and, indeed, specialist category of sensitve data).  A claim can be defended on the basis that the defendant took such care as was reasonably required in the circumstances.  This will be fact-specific.

If a breach is continuing a Court can order that the data controller cease processing personal data in the manner complained of.  A data subject may claim compensation if they suffer ‘damage’ as a result of a failure to comply with the Act.  Unlike many other areas of law, it is not necessary to prove financial loss and the Court can award compensation for distress alone.

A complaint can also be made to the ICO, which has the power to impose large fines (up to €20 million or 4% of turnover) on data controllers.

Unlike libel, in privacy claims the question of whether the information is true or false is not normally relevant to the issue of liability.  The critical issue will generally be whether there has been an unjustified interference with your private life.  Where the information is false there may also be a concurrent claim for defamation if the publication of it is likely to cause others to think less of you or shun you (and you have suffered serious reputational harm).

• To learn more about how we can help you bring a privacy claim click here to read our Privacy FAQs.