Enforcement · Information Commissioner (ICO) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Tavistock & Portman NHS Foundation Trust: Insufficient technical and organisational measures to ensure information security

€91,000 Fine
Tavistock & Portman NHS Foundation Trust
UNITED KINGDOM
Art. 5 GDPR Art. 32 GDPR
Security Healthcare Education IP Address Privacy by Design & Default Public Sector Processing Agreement Public Authority
Jun 9, 2022 Source

How it connects

Related across sources

Literature General Data Protection Regulation (GDPR) ambiguity, national diversity and data protection officer certification: Implementing Art. 39(1) GDPR in France, Italy, Luxembourg and Spain Journal of Data Protection Privacy Guidance Guidelines 05/2022 on the use of facial recognition technology in the area of law enforcement EDPB News What Happened to the Risk-Based Approach to Data Transfers? Future of Privacy Forum News UK data protection reform: How the UK's GDPR may change Hogan Lovells News Hervorming van de privacywetgeving in het Verenigd Koninkrijk: Hoe de GDPR van het VK mogelijk zal veranderen. Hogan Lovells Guidance Guidelines 07/2020 on the concepts of controller and processor in the GDPR EDPB

Full text

The UK DPA (ICO) has fined the Tavistock and Portman NHS Foundation Trust EUR 91,000. The Tavistock and Portman NHS Foundation Trust is a mental health specialist trust located in London. In early September 2019, the trust wanted to run a contest asking patients at the adult gender identity clinic to provide artwork to decorate a renovated clinic building. For this, two emails were inadvertently sent with an open distribution list (one to 912 recipients and the second to 869 recipients). It was clear from the content of the email that all recipients were patients of the clinic. The trust immediately recognized the error and unsuccessfully attempted to recall the emails. As part of its investigation, the IOC determined that the trust had no technical or organizational measures in place to prevent or mitigate this highly predictable human error. The ICO rated the harm to affected individuals as high given that information about the affected individuals' relationship with a gender identity clinic is very sensitive personal information. Due to immediate implementation of security measures and extensive cooperation with the ICO, the fine was reduced from EUR 910,000 to EUR 91,00.

Industry: Public Sector and Education

Original document at the source ico.org.uk

Similar Content