London NHS trust fined £180,000 after revealing email addresses of HIV service users


An NHS trust has been fined £180,000 after mistakenly revealing the email addresses of more than 700 people who use an HIV service.

The 56 Dean Street clinic in London's Soho sent out a newsletter last year to patients on a group email, rather than to individuals, meaning patients who have attended clinics there were able to read the names and email addresses of other patients.

The clinic and others in the trust's network make up Europe's biggest sexual health service.

Sign outside 56 Dean Street, an NHS clinic

Chelsea and Westminster Hospital NHS Foundation Trust, which runs the clinic, has been fined £180,000.

In total 730 of the 781 email addresses contained people's full name.

At the time of the incident in September, a trust spokesman said the mistake was caused by "human error".

Health Secretary Jeremy Hunt described the data breach as "completely unacceptable".

56 Dean Street Clinic in Soho

Announcing the fine, Information Commissioner Christopher Graham said: "People's use of a specialist service at a sexual health clinic is clearly sensitive personal data.

"The law demands this type of information is handled with particular care following clear rules, and put simply, this did not happen.

"It is clear that this breach caused a great deal of upset to the people affected. The clinic served a small area of London, and we know that people recognised other names on the list, and feared their own name would be recognised too.

Information Commissioner Christopher Graham

"That our investigation found this wasn't the first mistake of this type by the trust only adds to what was a serious breach of the law."

He added: "The trust was quick to apologise for their mistake, and has undertaken substantial remedial work since the breach.

"Nevertheless, it is crucial that the senior managers at NHS trusts understand the requirements of data protection law, and the serious consequences that follow when that law is broken."

Sign outside 56 Dean Street, an NHS clinic

Elliot Herman, who saw a copy of the email at the time, said he did not agree with the size of the fine.

Herman, who has since moved from London to Berlin, added that while initially he said he would have felt "angry and disappointed at the clinic", he had changed his mind and now thinks it was a simple error.

He said: "It was an easy mistake to make".