Personal data privacy risks
Reputational and privacy risks associated with increased use of personal data for content personalisation.
Source spread
Where this theme appears
This theme appears across 18 independent accountability sources, so the source mix matters as much as the headline total.
36 inquiry recs
11 PFD reports
197 committee recs
4 HSSIB recs
111 CQC actions
2 ICIBI recs
11 IOPC recs
3 NAO recs
5 IMB recs
1 detention investigation rec
40 DHR recs
18 PHSO decisions
281 LGO/SPSO decisions
6 ISC reports
1 CQC enforcement action
8 IPCO reports
Browse by source
Source-grouped records are useful for tracing where a concern came from. Large sections show the 50 strongest matches for that source; counts still show the full theme total.
Inquiry recommendations(36)
153 — Press reporting restraints
Recommendation: Consideration should be given to the desirability or otherwise of introducing further restraints on press reporting of proceedings before Children’s Hearings and in the Sheriff Court in children’s cases (18.35-36).
Unknown
146 — Confidential information to Sheriff
Recommendation: Provision should be made for the giving of information confidentially to the Sheriff (18.27).
Unknown
78 — Guide on disclosure by healthcare staff
Recommendation: The Prison Service should prepare a readable guide, which explains the circumstances in which personal information about a prisoner should be disclosed by healthcare staff to officers on the wing. The guide should contain practical examples of situations where disclosure …
Unknown
33 — Policy on disclosing medical reports to prisons
Recommendation: In the light of such legal advice as the Courts Service receives, it should publish a policy on the disclosure to the prison of medical or psychiatric reports on a prisoner submitted to the court.
Unknown
27 — NOMIS alert for sensitive security information
Recommendation: NOMIS should include a facility for an alert to appear if information is held by the Security Department on prisoners which could affect their management but which is too sensitive for wider dissemination. An officer at the grade of senior …
Unknown
L74 — Qualified One Way Costs Shifting
Recommendation: In the absence of the provision of an approved mechanism for dispute resolution, available through an independent regulator without cost to the complainant, together with an adjustment to the Civil Procedure Rules to require or permit the court take account …
Gov response: Mr Speaker, we have decided not to commence Section 40 of the Crime and Courts Act 2013 and to seek repeal at the earliest opportunity.
Not accepted
L73 — Civil Procedure Rules on Costs
Recommendation: The Civil Procedure Rules should be amended to require the court, when considering the appropriate order for costs at the conclusion of proceedings, to take into account the availability of an arbitral system set up by an independent regulator itself …
Gov response: Mr Speaker, we have decided not to commence Section 40 of the Crime and Courts Act 2013 and to seek repeal at the earliest opportunity.
Not accepted
L72 — Exemplary Damages for Media Torts
Recommendation: Exemplary damages (whether so described or renamed as punitive damages) should be available for actions for breach of privacy, breach of confidence and similar media torts, as well as for libel and slander. The application to a defendant of any …
Gov response: Two important but relatively small legislative changes need to be made. Let me explain what they are. First, Lord Justice Leveson said—the Government agreed at the time—that, in order to create an incentive for newspapers …
Accepted
L71 — Aggravated and Exemplary Damages
Recommendation: The Report of the Law Commission on Aggravated, Exemplary and Restitutionary Damages should be adopted in relation to its recommendations that legislation should provide that: (a) aggravated damages should only be awarded to compensate for mental distress and should have …
No response yet
L70 — Civil Justice Council Damages Review
Recommendation: The Civil Justice Council should consider the level of damages in privacy, breach of confidence and data protection cases, being prepared to take evidence (from the Information Commissioner, the media and others) and thereafter to make recommendations on the appropriate …
No response yet
L69 — Review of Damages for Media Torts
Recommendation: There should be a review of damages generally available for breach of data protection, privacy, breach of confidence or any other media-related torts, to ensure proportionate compensation including for non-pecuniary loss (all referable to the duration, extent and gravity of …
No response yet
L68 — PACE Amendments Consideration
Recommendation: The Home Office should consider and, if necessary, consult upon: (a) whether paragraph 2(b) of Schedule 1 to the Police and Criminal Evidence Act 1984 (PACE) should be repealed; (b) whether PACE should be amended to provide a definition of …
Gov response: The Home Office accept this recommendation we will consult on the proposed changes to PACE before the end of this year (2013). The consultation exercise will specifically consider the potential impact of the recommended change …
Accepted
L67 — Sentencing Guidelines for Data Offences
Recommendation: On the basis that the provisions of s77-78 of the Criminal Justice and Immigration Act 2008 are brought into effect, so that increased sentencing powers are available for breaches of s55 of the Data Protection Act 1998, the Secretary of …
No response yet
L66 — ICO Organisation Review
Recommendation: The Information Commissioner's Office should take the opportunity to review its organisation and decision-making processes to ensure that large-scale issues, with both strategic and operational dimensions (including the relationship between the culture, practices and ethics of the press in relation …
Gov response: As explained above the management structure and controls that we now have in place are very different from those that existed at the time of the events Lord Justice Leveson looked at in the greatest …
Accepted
L65 — ICO Specialist Knowledge Review
Recommendation: The Information Commissioner's Office should take the opportunity to review the availability to it of specialist legal and practical knowledge of the application of the data protection regime to the press, and to any extent necessary address it.
Gov response: We have undertaken this review and recognise the need to have more specialist knowledge of the workings of the press and the application of the data protection regime to them.
Accepted
L64 — ICO Engage with Metropolitan Police
Recommendation: The Information Commissioner's Office should take immediate steps to engage with the Metropolitan Police on the preparation of a long-term strategy in relation to alleged media crime with a view to ensuring that the Office is well placed to fulfil …
Gov response: The ICO fully accepts this recommendation. Section 10 of the ACPO Manual of Guidance (MoG) sets out the policy and procedure for investigations in relation to cases not involving the police. However, it does not …
Accepted
L63 — ICO Adopt DPP Guidelines
Recommendation: The Information Commissioner's Office should immediately adopt the Guidelines for Prosecutors on assessing the public interest in cases affecting the media, issued by the Director of Public Prosecutions in September 2012.
Gov response: As noted above, the ICO had, by the time Lord Justice Leveson’s Report was published, already endorsed and adopted the CPS Guidelines for Prosecutors on assessing the public interest in cases affecting the media, issued …
Accepted
L62 — ICO Annual Report on Press
Recommendation: The Information Commissioner's Office, in the Annual Report to Parliament which it is required to make by virtue of section 52(1) of the Act, should include regular updates on the effectiveness of the foregoing measures, and on the culture, practices …
Gov response: The ICO fully accepts the spirit of this recommendation. We will provide regular updates to Parliament on the effectiveness of the measures we are adopting in response to Lord Justice Leveson’s recommendations and more generally …
Accepted
L61 — ICO Advice for Data Subjects
Recommendation: In particular, the Information Commissioner's Office should take immediate steps to publish advice aimed at individuals (data subjects) concerned that their data have or may have been processed by the press unlawfully or otherwise than in accordance with good practice.
Gov response: We understand the importance of ensuring that individuals are fully aware of their rights should they be concerned that their data has been or may have been processed by the press or other media organisations …
Accepted
L60 — ICO Public Guidance
Recommendation: The Information Commissioner's Office should take steps to prepare and issue guidance to the public on their individual rights in relation to the obtaining and use by the press of their personal data, and how to exercise those rights.
Gov response: We recognise the importance of developing this guidance, which we will develop and publish in conjunction with the proposed Code of Practice mentioned above. We will also aim to have this guidance ready by the …
Accepted
L59 — ICO Good Practice Guidelines
Recommendation: In discharge of its functions and duties to promote good practice in areas of public concern, the Information Commissioner's Office should take immediate steps, in consultation with the industry, to prepare and issue comprehensive good practice guidelines and advice on …
Gov response: We recognise the need for the ICO to prepare this guidance, based on the DPA as it currently stands. We also recognise the importance of consultation with the press and broadcasting industry.
Accepted
L58 — ICO Policy on Press Regulation
Recommendation: The Information Commissioner's Office should take immediate steps to prepare, adopt and publish a policy on the exercise of its formal regulatory functions in order to ensure that the press complies with the legal requirements of the data protection regime.
Gov response: The ICO accepts this recommendation. We are now in the process of revising our Data Protection Regulatory Action Policy so that it specifically addresses how we will use our regulatory powers to ensure that the …
Accepted
L57 — Reconstitute ICO as Commission
Recommendation: The opportunity should be taken to consider amending the Data Protection Act 1998 formally to reconstitute the Information Commissioner's Office as an Information Commission, led by a Board of Commissioners with suitable expertise drawn from the worlds of regulation, public …
No response yet
L56 — ICO Consult with CPS
Recommendation: A new duty should be introduced (whether formal or informal) for the Information Commissioner's Office to consult with the Crown Prosecution Service in relation to the exercise of its powers to undertake criminal proceedings.
No response yet
L55 — ICO Prosecution Powers Extension
Recommendation: The prosecution powers of the Information Commissioner should be extended to include any offence which also constitutes a breach of the data protection principles.
No response yet
L54 — Bring into Force Section 55 Penalties
Recommendation: The necessary steps should be taken to bring into force the amendments made to section 55 of the Data Protection Act 1998 by section 77 of the Criminal Justice and Immigration Act 2008 (increase of sentence maxima) to the extent …
Gov response: I think we need to look at this very carefully. Lord Justice Leveson is incredibly tough about what he sees as the failures to act on the Information Commissioner’s report. We need to look very …
Noted
L53 — ICO Regard for Regulatory Membership
Recommendation: Specific provision should be made to the effect that, in considering the exercise of any of its powers in relation to the media or other publishers, the Information Commissioner's Office must have regard to the application to a data controller …
No response yet
L52 — ICO Balance of Public Interest
Recommendation: In conjunction with the repeal of those procedural provisions, consideration should be given to the desirability of including in the Data Protection Act 1998 a provision to the effect that, in considering the exercise of any powers in relation to …
No response yet
L51 — Repeal Procedural Provisions
Recommendation: The procedural provisions of the Data Protection Act 1998 with special application to journalism in: (a) section 32(4) and (5) (b) sections 44 to 46 inclusive should be repealed.
Gov response: In support of this, Lord Justice Leveson makes some important proposals. First, he proposes some changes to the Data Protection Act that would reduce the special treatment that journalists are afforded when dealing with personal …
Noted
L49 — Narrow Section 32 Exemption Scope
Recommendation: The exemption in section 32 of the Data Protection Act 1998 should be narrowed in scope, so that it no longer allows, by itself, for exemption from: (a) the requirement of the first data protection principle to process personal data …
Gov response: In support of this, Lord Justice Leveson makes some important proposals. First, he proposes some changes to the Data Protection Act that would reduce the special treatment that journalists are afforded when dealing with personal …
Noted
L48 — Section 32 DPA Amendment
Recommendation: The exemption in section 32 of the Data Protection Act 1998 should be amended so as to make it available only where: (a) the processing of data is necessary for publication, rather than simply being in fact undertaken with a …
Gov response: In support of this, Lord Justice Leveson makes some important proposals. First, he proposes some changes to the Data Protection Act that would reduce the special treatment that journalists are afforded when dealing with personal …
Noted
DM-10 — Custodial sentences for data protection offences
Recommendation: Given the potential seriousness of such offences, it is recommended that the Government take an early opportunity to amend the Data Protection Act 2018 to provide for sentences of imprisonment for offenders.
Gov response: 2.4.7. In light of the Special Prosecutor’s conclusion that former DCS David Cook disclosed personal data in the sending of emails to a journalist, Michael Sullivan, the Panel recommended the introduction of custodial sentences for …
Not accepted
SP23 — Coroner and inquiry Ofcom notification powers
Recommendation: The Department for Science, Innovation and Technology should consider extending the powers under the Online Safety Act 2023 to enable Senior Coroners to make a notification to Ofcom to obtain access to social media accounts of perpetrators (not just of …
Gov response: The Department for Science, Innovation and Technology (DSIT) is the lead department, with input from other government departments. Progress and next steps: - DSIT has initiated a review of the existing powers available to Senior …
Accepted
F244 — Common information practices shared data and electronic records
Recommendation: There is a need for all to accept common information practices, and to feed performance information into shared databases for monitoring purposes. The following principles should be applied in considering the introduction of electronic patient information systems: Patients need to …
Gov response: Accepted. There is both a need for common information practices that support the extraction of data to central systems to support improvements in data quality and service provision, and a need for electronic patient systems. …
Accepted
L78 — PNC Access Auditing
Recommendation: The Police Service should re-examine the rigour of the auditing process and the frequency of the conduct of audits in relation to access to the Police National Computer (PNC). Additional consideration should also be given to the number of people …
Gov response: The Metropolitan Police Service, Her Majesty's Inspectorate of Constabulary and Fire & Rescue Services and the College of Policing have implemented or are implementing all of the Inquiry’s recommendations in relation to law enforcement. For …
Accepted
TAYL-F39 — Clubs maintain computer records of ticket purchasers' names and addresses
Recommendation: Clubs should consider maintaining a record on computer of ticket sales before the day of the match, for season tickets and tickets for all-ticket matches for seated areas, containing the names and addresses of those purchasing tickets.
Unknown
Prevention of Future Deaths reports(11)
Roshan Abbas Ladak-Ebrahim
Concerns: The coroner identified a need for clearer guidance on assessing self-harm risk and ensuring patient safety, including clarification on not leaving at-risk patients alone and confidentiality. Concerns also related to doctors consulting with patients before and after prescribing medication with an increased self-harm risk.
Response (Department of Health): • The Department of Health confirmed it had worked with Royal Colleges and professional organisations to agree and publish a consensus statement on information sharing to prevent suicide. • The … (AI summary)
Responded
William Dowling & Victoria Rose
Concerns: The coroner notes that General Practitioners lack a national mechanism to report ongoing patient information relevant to firearms license suitability due to confidentiality, potentially impeding crucial decisions for public safety. A pilot scheme has demonstrated the benefit of such information sharing.
Overdue
Alun Sheppard
Concerns: The coroner raised concerns regarding the Health Board's ability to balance a patient's right to confidentiality with the potential benefits of facilitating familial support to optimize recovery.
Response (NHS Wales): • The Health Board stated that mental health practitioners routinely encourage service users to engage with family members and increase support networks. • The Health Board confirmed its policy is … (AI summary)
Responded
Chentoori Chanthirakumar
Concerns: Barts and the London might consider face-to-face meetings for significant academic decisions instead of email. East London Trust staff need clarity on patient confidentiality, distinguishing between receiving information from third parties and disclosing patient details.
Overdue
Joseph Dune
Concerns: The coroner noted breaches in Information Governance protocols, identifying that clinicians could access and alter patient medical records using colleagues' log-ins, and that these changes were not visible to treating clinicians without an IT audit.
Overdue
Lindsey Bailey
Concerns: The coroner noted a significant lack of relevant information being shared with Ms Bailey's parents, despite her mental capacity and agreement for information sharing.
Response (Midland Partnership NHS Trust): • The Trust stated it would develop a standard letter template for families and carers where information sharing has been agreed, to be implemented by November 2019. • The Trust … (AI summary)
Responded
Sam Grant
Concerns: Concerns were raised regarding a lack of accessible lower-level mental health support for young people who do not meet CAMHS thresholds. There were also gaps in information sharing between the GP, CAMHS, and school, hindering a comprehensive understanding of the individual's needs.
Overdue
Rebecca Henry
Concerns: The coroner highlighted a lack of communication between mental health professionals and patients' relatives due to confidentiality, noting that relatives often hold valuable information which could aid care decisions.
Response (Department of Health and Social Care): • The Department of Health and Social Care published the "Information sharing and suicide prevention: Consensus statement" in 2014 to promote greater information sharing. • The Government accepted the recommendation … (AI summary)
Responded
Angela Frost
Concerns: The Trust has no formal guidance for Consultant Psychiatrists, other healthcare professionals, or family members to seek second opinions on diagnosis, treatment, or detention criteria. There is also a lack of understanding among in-patient Consultants regarding confidentiality rules when communicating with family members.
Response (Pennine Care NHS Foundation Trust): • A draft process for requesting second opinions has been written and will be submitted to the Trust's Quality Group for scrutiny and sign-off. • An individual Consultant Psychiatrist is … (AI summary)
Responded
Donna Constantine
Concerns: The coroner raised concerns that unmonitored police work mobile phones, given to vulnerable people, could delay urgent responses when officers are off duty, and noted a lack of clear escalation policies or audit trails for these direct contacts.
Response (Home Office): • The Home Office stated it would continue to liaise with the National Police Chiefs Council (NPCC) and the College of Policing (CoP) on policing policy development. • The Home … (AI summary)
Response (National Police Chiefs' Council): • The Victims Code was updated in April 2021 to include 12 overarching rights and to promote victim-led contact and single points of contact. • National forces are not encouraged … (AI summary)
Responded
Callum Wong
Concerns: The coroner raises concerns about considering exceptions to patient confidentiality in mental ill-health cases, where informing third parties could provide crucial non-medical support.
Overdue
Select committee recommendations(197)— showing 50 strongest matches
#19 —
Recommendation: Given the severe infringement on the right to privacy posed by the imposition of electronic monitoring, the threshold test for electronic monitoring should be one of “necessity and proportionality”, not whether it is “appropriate”. Clause 52 should be amended accordingly. …
Response attribution not verified
#11 —
Recommendation: We recommend that the Home Office and the security agencies engage with the Investigatory Powers Commissioner so they can review any journalistic material which has been retained and remains retained before this Remedial Order is made to ensure that it …
#10 —
Recommendation: We recommend that the Government proceeds to lay a draft order before both Houses once the Remedial Order has been modified in accordance with our recommendation concerning retention. (Paragraph 48) Other matters arising
#1 —
Recommendation: We welcome the Government’s action in proposing the draft Remedial Order to rectify the incompatibility of the UK’s bulk communications interception regime as regards confidential journalistic material and sources of journalistic material, as protected by Article 10 (freedom of expression …
#9 —
Recommendation: If a decision is made to create a Central Bank Digital Currency, the Bank and HM Treasury will need to clarify what effect this would have on the framework for operational independence and the primary objectives of the Bank. They …
Response attribution not verified
#12 —
Recommendation: While the Government maintains that UK victims should not pay ransoms, it is the only viable option for many of those directly affected, enabling them to keep their businesses afloat and prevent damaging leaks of personal data. Too many organisational …
Response attribution not verified
#197 —
Recommendation: The Probation Service should improve communications with its partners. This could include guidance on what can, or cannot, be shared under data protection legislation. It should consider granting them direct access to its databases, as used to be the case …
Response attribution not verified
#13 —
Recommendation: We are satisfied that the Draft Remedial Order would adequately address the incompatibilities with Article 10 ECHR (freedom of speech) identified by the Grand Chamber in the Big Brother Watch case concerning the examination and retention of journalistic material.
#12 —
Recommendation: We are satisfied that the Draft Remedial Order would bring the bulk interception regime under the IPA into line with the requirements of Article 10 ECHR regarding authorisation for retention, as set out by the Grand Chamber in the Big …
#11 —
Recommendation: We are surprised by the Home Office’s statement that the IPCO does not have a mechanism for facilitating urgent approvals by Judicial Commissioners outside standard working hours. We therefore encourage the Home Office to engage with the IPCO to see …
#10 —
Recommendation: In light of the particular importance of the maintenance of journalistic freedoms under Article 10 ECHR, we recommend that the IC Code is updated to give clear guidance on the meaning of ‘urgent’ in the specific context of authorisations by …
#1 —
Recommendation: We welcome the Government’s action in laying the Draft Remedial Order to rectify the incompatibility of the UK’s bulk communications interception regime as regards the protection of confidential journalistic material and sources of journalistic material, as protected by Article 10 …
#47 —
Recommendation: The Government should clarify its intentions concerning sharing data about employee hours with other Government departments and agencies. It should consult with relevant stakeholders before any such sharing takes place, even if it is permitted under existing powers.
Response attribution not verified
#36 —
Recommendation: The Department for Health and Social Care should work with NHS bodies to ensure future proof data protection provisions are embedded in licensing terms. This would help reassure patients given the possibility of LLM businesses working with NHS data being …
Response attribution not verified
#35 —
Recommendation: Further clarity on data protection law is needed. The Information Commissioner ’s Office should work with DSIT to provide clear guidance on how data protection law applies to the complexity of LLM processes, including the extent to which individuals can …
Response attribution not verified
#24 —
Recommendation: The Digital Regulation Cooperation Forum should establish a dedicated workstream examining areas of regulatory crossover , conflict and collaboration that will affect the news sector—focusing in particular on privacy, advertising and competition.
Response attribution not verified
#24 —
Recommendation: The Government should make every effort to maintain a regular dialogue with counterparts on regulation and legislation on a variety of issues affecting digital trade. These might include regulation of emerging technologies, approaches to data, or digitisation of trade documents. …
Response attribution not verified
#21 —
Recommendation: We encourage the Government to continue working with like-minded partners towards establishing a consensus on issues such as cross-border data flows and other digital trade governance issues. We note that it may need to continue to do so in the …
Response attribution not verified
#14 —
Recommendation: We welcome the Government’s confirmation to the European Affairs Committee that it stands ready to engage with the European Commission, European Parliament and other relevant stakeholders to support a successful renewal of the EU’s data adequacy decisions as a matter …
Response attribution not verified
#12 —
Recommendation: The EU is the UK’s largest trading partner. Given that digital trade is of particular importance to the UK and considering that free flows of data underpin digital trade, it is imperative that the Government secures a positive adequacy decision …
Response attribution not verified
#11 —
Recommendation: We welcome the Government’s confirmation that it is working with the European Commission to ensure that its Data (Use and Access) Bill is compatible with a positive EU adequacy decision in June 2025.
Response attribution not verified
#7 —
Recommendation: We recognise that the proposals do not extend to naming individuals under investigation publicly. We believe, however that there is a serious risk inherent in the FCA’s proposals that senior managers and other key individuals involved in a firm under …
#45 —
Recommendation: The AI Bill we recommend should prohibit the use of AI in ways that are inconsistent with respect for human rights, such as subliminal techniques, emotional inference or inappropriate use of profiling or biometric data. Because of the very serious …
#5 —
Recommendation: AI systems pose particular risks to privacy and personal data, because of the prevalence of web scraping to collect personal data to train large language models (LLMs), and the potential for AI systems to be used in highly intrusive ways. …
#12 —
Recommendation: Martin Lewis told us that, as with social tariffs, the system places the burden on people in vulnerable circumstances to declare those circumstances to companies and to ask for support.33 CCW told us that, for those consumers who are aware, …
#5 —
Recommendation: The definition of “sensitive information” in clause 16(1) of the bill should be amended, either by (1) removing the possibility that a mere “risk” of damage makes information “sensitive information”, thereby bringing the definition into line with the definition used …
Response status not verified
#30 —
Recommendation: The obligations examined in this report arose from the UK’s long involvement in Afghanistan, the commitments made to Afghans who supported the UK mission, and the additional risks created by the data breach. The government and local partners have brought …
Response status not verified
#20 —
Recommendation: The UK’s obligations after the breach were wider than its pre-existing ARAP commitments. The government had continuing obligations to eligible Afghans to whom public commitments had been made after Op PITTING, and additional responsibilities to people placed at increased risk …
Response attribution not verified
#16 —
Recommendation: The government approached notification of affected Afghans primarily as a communications exercise rather than as a safeguarding intervention. Although the notification reached most affected individuals, it did not provide sufficiently specific, actionable or individualised information to enable people to understand …
Response status not verified
#6 —
Recommendation: The Afghan data-breach injunction was an exceptional measure with profound constitutional consequences. Even aside from the “superinjunction” element, it prevented public and parliamentary knowledge of a major policy response involving risk to life, substantial public expenditure and affected communities across …
Response status not verified
#5 —
Recommendation: Government should mandate and enforce minimum standards for skills, process, tools, controls, independent assurance and testing for datasets where compromise could plausibly risk life. The MOD should also explain who held senior official responsibility for data-protection risk in ARAP before …
Response status not verified
#4 —
Recommendation: Describing the breach as a systemic failure does not mean that responsibility lay nowhere. Institutional accountability requires clear lines of responsibility. Where a department takes on unfamiliar responsibilities involving life-endangering data, clear senior ownership of risk, assurance and data protection …
Response status not verified
#3 —
Recommendation: The breach was not simply an individual mistake, but a foreseeable systemic failure. It arose from the combination of inappropriate tools, weak operating procedures, insufficient training, poor organisational continuity, and an inadequate culture of data protection and accountability. The pressures …
Response status not verified
#55 —
Recommendation: Legal aid providers and clients have been insufficiently compensated for the additional work and data loss caused by the 2025 cyber- attack. The response of the Legal Aid Agency and Ministry of Justice to informing and safeguarding victims has not …
Response status not verified
#21 —
Recommendation: The UK’s research base is operating in an increasingly contested global environment. The risks to research security are growing but the UK’s response is insufficiently developed. Though the recent breach at UK Biobank illustrated how research collaborations can be exploited …
Response status not verified
#14 —
Recommendation: Section 62 IMA should be amended, as recommended by our predecessor Committee, to make clear that the credibility of a claimant who has provided a reasonable excuse for their failure to provide a password or other methods of access requested …
Response attribution not verified
#9 —
Recommendation: We are concerned that clause 35(7) and (8), deeming transfer of personal data to third countries and international organisations to be necessary for important reasons of public interest, inappropriately disapplies the normal safeguards in data protection legislation when data is …
Response attribution not verified
#162 —
Recommendation: recommendation Given the severe infringement on the right to privacy posed by the imposition of electronic monitoring, the threshold test for electronic monitoring should be one of “necessity and proportionality”, not whether it is “appropriate”. Clause 52 should be amended …
Response attribution not verified
#161 —
Recommendation: The power to impose electronic monitoring engages Article 8, which requires that any interferences with the right to private and family life are in accordance with the law, in pursuit of a legitimate aim and necessary and proportionate to that …
Response attribution not verified
#160 —
Recommendation: Open Rights Group note that “the Bill’s provisions offer limited procedural safeguards (for instance, reliance on “reasonable grounds” rather than rigorous independent judicial oversight). Such a low threshold can lead to overly broad applications of state power.”201 Migrant Help states …
Response attribution not verified
#159 —
Recommendation: Clause 52 provides the courts with the power to impose electronic monitoring200 as part of SCPO requirements. Electronic monitoring can be imposed where there are “reasonable grounds to believe that the [overall] order would protect the public” and that this …
Response attribution not verified
#157 —
Recommendation: The Bill provides power to impose electronic monitoring as a requirement of a Serious Crime Prevention Order (SCPO). It also provides for the power to impose interim SCPOs whilst an application for a final order is pending. SCPOs, introduced by …
Response attribution not verified
#149 —
Recommendation: recommendation The requirements in clause 43 for imposing conditions such as electronic monitoring, geographical exclusions, and curfews, should be set out clearly on the face of the Bill and adequately circumscribed. In order to reflect the Government’s intentions as stated …
Response attribution not verified
#143 —
Recommendation: The current restrictions, set out in section 3(1)(c) of the Immigration Act 1971, permit restrictions to be placed on individuals such as restrictions on the right to work and study, requirements to report to immigration officers, and residency requirements. The …
Response attribution not verified
#142 —
Recommendation: At Committee stage in the Commons, the Government added clause 43. This introduces an extension of the existing conditions that may be applied to any grant of limited leave to enter or remain in the UK under section 3(1) (c) …
Response attribution not verified
#134 —
Recommendation: This clause also engages Article 8 because it gives powers to obtain biometrics and search documents. An interference with this right must be in accordance with the law and proportionate to the pursuit of a legitimate aim. It is the …
Response attribution not verified
#128 —
Recommendation: The clause also amends section 141 of the Immigration Act 1999 (fingerprinting) and regulation 2 of the Immigration (Collection, Use and Retention of Biometric Information and Related Amendments) Regulations 2021 (photographs) to clarify that fingerprints and photographs can be taken …
Response attribution not verified
#126 —
Recommendation: recommendation Section 62 IMA should be amended, as recommended by our predecessor Committee, to make clear that the credibility of a claimant who has provided a reasonable excuse for their failure to provide a password or other methods of access …
Response attribution not verified
#125 —
Recommendation: In respect of this provision, the previous JCHR concluded in its report on the Illegal Migration Bill: “we remain concerned that an asylum or human rights claimant’s credibility should not be damaged by conduct that may be explained by something …
Response attribution not verified
#124 —
Recommendation: The Bill does not repeal section 62 IMA. This means that if a person making a human rights or asylum claim does not allow the Home Office to look at everything (including private information) on their phone, then the Home …
Response attribution not verified
HSSIB safety recommendations(4)
Insulin: supporting safe self-administration for patients in the community with a disability
Does your organisation provide practical guidance to staff to help identify when it is lawful, ethical and appropriate to share confidential information about a patient to mitigate risks to their safety, including with family members?
Learning Prompt
Access to critical patient information at the bedside
HSIB recommends that the Office of the National Data Guardian supports local interpretation of the Caldicott Principles to give organisations and staff the confidence to display full patient names at the bedside to support correct patient identification for safer care.
Safety Recommendation
Healthcare provision in prisons: data sharing and IT
HSSIB recommends that HM Prison and Probation Service ensures that the development of the Digital Prison Services system includes interoperability with healthcare IT systems. This will ensure that information which does not impinge on the confidentiality requirements of either system, …
Safety Recommendation
Access to critical patient information at the bedside
It may be beneficial for healthcare organisations to provide guidance to support decisions in clinical areas that balance confidentiality and the visibility of critical patient information for patient safety.
Safety Observation
CQC inspection actions(111)— showing 50 strongest matches
Worthing Hospital
The trust must ensure they take measures to restrict unauthorised access patient record documents.
Must Do
William Harvey Hospital
The trust must ensure they keep patient records secure.
Must Do
William Harvey Hospital
The trust must ensure all computer terminals are locked when not in use
Must Do
Westmorland General Hospital
The trust should ensure that privacy and confidentiality is maintained for patients when sharing personal information.
Should Do
Westmorland General Hospital
The trust should ensure patient records are stored securely.
Should Do
West Cumberland Hospital
The trust must ensure that all patient records are stored securely across the medical division to adhere to patient confidentiality and general data protection regulation (GDPR) guidelines.Regulation17(1)(2)(c).
Must Do
The York Hospital
The service should ensure ED staff keep records for patients on trolleys waiting in the ambulance arrival corridor secure.
Should Do
The York Hospital
The trust should ensure that patient information on whiteboards remains confidential throughout the service and is not located in areas where the general public can see it.
Should Do
Scarborough Hospital
The service should ensure ED staff keep records for patients on trolleys waiting in the ambulance arrival corridor secure.
Should Do
Scarborough Hospital
The trust should ensure that patient information on whiteboards remains confidential throughout the service and is not located in areas where the general public can see it.
Should Do
Scarborough Hospital
The service must ensure ED staff maintain detailed records of patient’s care and treatment, so they are clear, up to date and stored securely.
Must Do
Salford Royal Hospital
The service should ensure staff store patient records and information securely.
Should Do
Salford Royal Hospital
The service should ensure staff store patient records and information securely.
Should Do
Salford Royal Hospital
The service should ensure staff store patient records and information securely.
Should Do
Royal Victoria Infirmary
The service should ensure that service user records are stored securely.
Should Do
Royal Preston Hospital
The trust must ensure that patient identifiable information is not visible to visitors to the department
Must Do
Royal Preston Hospital
The service must ensure that patient records are kept secure.
Must Do
Royal Preston Hospital
The trust must ensure that patient identifiable information is not visible to visitors to the department
Must Do
Rochdale Infirmary
The service should ensure staff store patient records and information securely.
Should Do
Rochdale Infirmary
The service should ensure staff store patient records and information securely.
Should Do
Rochdale Infirmary
The service should ensure staff store patient records and information securely.
Should Do
Queen's Hospital
The service must ensure patient records are kept securely in locked notes trolleys and that when patient records are in use, that they are not left unattended.
Must Do
Queen Elizabeth The Queen Mother Hospital
The trust must ensure they keep patient records secure.
Must Do
Queen Elizabeth The Queen Mother Hospital
The trust must ensure all computer terminals are locked when not in use
Must Do
Pilgrim Hospital
The trust should ensure all patient records and other person identifiable information is kept secured at all times.
Should Do
Northwick Park Hospital
The trust should ensure records are always stored securely, to ensure unauthorised people cannot access patients’ confidential information.
Should Do
Northwick Park Hospital
The trust must ensure patient records are always stored securely and cannot be accessed by unauthorised people.
Must Do
North Manchester General Hospital
The trust should ensure records containing patient sensitive information are not left on open shelves in view of people passing through the corridor, including other patients.
Should Do
Montagu Hospital, Mexborough
Thetrustshouldensureitalwayskeeprecordssecure.
Should Do
Kidderminster Hospital and Treatment Centre
The service must ensure that information technology systems which record private and confidential patient information are not visible to patients, visitors and unauthorised personnel.
Must Do
Kettering General Hospital
The service should ensure that records trolleys on wards are always kept closed and locked when not in use.
Should Do
Kettering General Hospital
The service should ensure electronic patient data boards on wards protects patient confidentiality.
Should Do
Kettering General Hospital
The servicemust ensure any patient record data held electronically is stored on devices which are kept securely within the service.
Must Do
Kettering General Hospital
The servicemust ensure it introduces a system to improve the security of patient paper notes.
Must Do
Fleetwood Hospital
The trust should ensure that all staff follow the trust’s information security policy when sending sensitive emails to other organisations.
Should Do
Ellesmere Port Hospital
The trust should ensure that patient identifiable details are kept confidential when displayed or stored in public areas.
Should Do
Ealing Hospital
The trust must ensure patient records are always stored securely and cannot be accessed by unauthorised people.
Must Do
Doncaster Royal Infirmary
The trust should ensure it always keep records secure.
Should Do
Diana Princess of Wales Hospital
The trust must ensure patient records are stored securely.
Must Do
Diana Princess of Wales Hospital
The service must ensure patient records are stored securely and confidential waste is stored securely and disposed of in line with national guidance and trust policy.
Must Do
Cumberland Infirmary
The trust must ensure that all patient records are stored securely across the medical division to adhere to patient confidentiality and general data protection regulation (GDPR) guidelines. Regulation 17(1)(2)(c).
Must Do
Cumberland Infirmary
The trust must ensure that all patient records are stored securely across the medical division to adhere to patient confidentiality and general data protection regulation (GDPR) guidelines. Regulation 17(1)(2)(c)(d).
Must Do
Cumberland Infirmary
The trust must ensure that all patient records are stored securely across the medical division to adhere to patient confidentiality and general data protection regulation (GDPR) guidelines. Regulation 17(1)(2)(c).
Must Do
Colchester General Hospital
The trust should ensure patient and staff records are stored securely to maintain confidentiality and compliance with the trust policy and national legislation.
Should Do
Clatterbridge Hospital
The services should continue to maintain paper record security whilst in the main outpatient department.
Should Do
Clatterbridge Hospital
The service should ensure that records trolleys are locked when not in use.
Should Do
Chorley and South Ribble Hospital
The service should ensure that patient identifiable details are not displayed on public boards.
Should Do
Chorley and South Ribble Hospital
The trust must ensure that patient identifiable information is not visible to visitors to the department
Must Do
Chorley and South Ribble Hospital
The service must ensure that patient records are kept secure.
Must Do
Castle Hill Hospital
The service should ensure that confidential records are stored securely in line with national guidance.
Should Do
ICIBI immigration recommendations(2)
An inspection of the Home Office’s management of fee waiver applications (August …
Review and document the lawful basis for storing Equifax reports on Home Office systems, including the retention of such reports beyond the point where a fee waiver decision has been …
An inspection of Border Force insider threat (January – March 2023)
Ensure relevant data from vetting, Home Office Security, and Human Resources is available to Border Force, in order to allow Border Force to create a comprehensive insider threat picture to …
IOPC learning recommendations(11)
Recommendations - Surrey Police, August 2020
The IOPC recommends that Surrey Police should ensure all custody officers and staff are made aware of and understand any new measures and guidance that are implemented to prevent the routine CCTV recording of strip and intimate searches of detainees. …
Recommendation - Durham Constabulary, July 2024
The IOPC recommends that Durham Constabulary should conduct a review into the way it shares people's personal and sensitive information with a view to ensuring relevant staff are appropriately trained and understand the powers they are using, and that processes …
Recommendation - Metropolitan Police Service, January 2021
The IOPC recommends that the Metropolitan Police Service (MPS) should make their Information Code of Conduct and MPS Security Code policies clear that officers should not use their personal phones to contact members of the public unless there are no …
Recommendations - Cleveland Police, February 2021
The IOPC recommends Cleveland Police assesses whether there is a general problem with the manner in which emails are used internally or whether it is particular to individual members of staff. If appropriate, staff should be reminded of the manner …
Recommendations - Surrey Police, August 2020
The IOPC recommends that Surrey Police review and update the CCTV in Custody policy (v4.02.19) to reflect: a) that it is not standard procedure to CCTV record strip or intimate searches, and that the recording of such searches should not …
Recommendations - Surrey Police, August 2020
The IOPC recommends that all Surrey Police custody implement measures in its custody suites to prevent the routine CCTV recording of strip and intimate searches of detainees, as soon as reasonably practicable. This follows an investigation where a female was …
National recommendation - The National Police Chiefs' Council, December 2020
The IOPC recommends that the National Police Chiefs’ Council shares the learning from recent IOPC investigations with relevant force custody leads, asking them to review and update their custody and CCTV policies to reflect: a) that strip and intimate searches …
Recommendation - Greater Manchester Police, March 2022
The IOPC recommends that Greater Manchester Police produce guidance on how officers should raise safeguarding concerns regarding a member of the public they know in a personal capacity. This follows an IOPC appeal where officers shared information regarding a member …
Investigation into recruitment irregularities and the actions of a civilian staff member …
The IOPC recommends that British Transport Police puts in place mechanisms to monitor deletion of documents or files from shared and personal computer drives and to recover them where appropriate. In this investigation, allegations were made about the deletion of …
Investigation into recruitment irregularities and the actions of a civilian staff member …
The IOPC recommends that British Transport Police put in place a robust process for visitors to BTP premises to sign in and, where appropriate, be accompanied by a BTP employee. The IOPC investigation examined visitor logs for BTP’s Leeds office …
Recommendation - Sussex Police, March 2023
The IOPC recommends that Sussex Police should take steps to ensure that details/identity of all officers/custody staff present are documented in the custody record when: A detainee is searched in custody (irrespective of the level of search)A detainee has their …
NAO audit recommendations(3)
A digital BBC
set out how it plans to develop its personalisation strategy, including managing potential data risks. As it moves towards greater use of personal data and sign-in, the BBC now needs to fully develop a comprehensive personalisation strategy. This should include …
Accepted
Child Maintenance Client Funds Accounts 2020-21: 1993 and 2003 Schemes Account
• reviews its interpretation of the 2018 General Data Protection Regulations to ensure that it retains records to meet its responsibilities to ensure adequate accounting records are retained and available for audit, in line with requirements of the Companies Act …
Accepted
Administration of Scottish income tax 2019-20
HMRC should review, by March 2022, how it can enhance the effectiveness of its third-party data comparison exercise in providing assurance over the accuracy of its address records, and in doing so should consider: • what additional action can be …
Accepted
IMB individual recommendations(5)
Downview (2024)
What lessons have been learnt from the management of this situation [a suspected data breach involving Rule 39 correspondence]?
Other
Implemented
Wakefield (2022)
We ask HMPPS to consider if it is necessary for the prisoner’s index offence to be highly visible on the opening page of the prisoner record on the Digital Prison Services systems (this was not the case with the legacy P-NOMIS system).
HMPPS
Rejected
Woodhill (2025)
Will the Governor ensure robust measures are in place so that prisoners do not enter the office in House Units and have access to confidential papers?
Governor / Director
Yarl’s Wood (2020)
The Board recommends that the systems and procedures in place for processing small boat migrants are more careful and thorough to ensure that those arriving at IRCs do so accompanied by the correct personal information.
Home Office
Heathrow Immigration Removal Centre (2020)
The practice of conducting the majority of DET consultations with detainees over the telephone should be reviewed in order to ensure that all discussions which might be considered ‘sensitive’ are held in person, whilst in line with whatever Government pandemic guidance is current at the time.
Home Office
Health investigations(47)
Independent investigation: Robert MitchellArthur WilsonShirley Wilson, Bramford, Suffolk (1994) — Rec B
The question of confidentiality of prison medical records should be fully reviewed. As a first step towards such review, the General Medical Council and other professional bodies should be asked for their views.
east_of_england
Independent investigation: Virginia Griffiths, Hornchurch (2008) — Rec R1
The trust should ensure that its guidance on allowing staff access to information about clients they are not directly working with protects that client from unnecessary disclosure, but does not inhibit staff who need information for legitimate clinical/therapeutic reasons.
london
Independent investigation: Thelma Allum, Maidenhead, Berks (1997) — Rec 2
that, to this end, a protocol should be developed which addresses the issue of confidentiality and the sharing of information between agencies. This should emphasise the importance of considering— • who is most at risk of violence; • whether these individuals are aware of the risk, the history of violence, …
south_east
Independent investigation: Sarah Smart, Oxford (2005) — Rec 15.5
In working with the above two recommendations the Crisis Resolution and Home Treatment Team will need to develop practice on working with Service Users’ consent to sharing and collecting information on a routine level.
south_east
Independent investigation: Lisa Sullivan, Walton on the Naze (2005) — Rec 12
When a homicide occurs there will necessarily be an Independent Investigation. The HPFT should ensure that the clinical records and all relevant documents are held securely, including the records which comprise the archive of the Internal Investigation undertaken by the Trust until the Independent Investigation is complete.
east_of_england
Independent investigation: Lin & Megan Russell, Kent (1996) — Rec Paragraph 8
When homicide inquiries are set up, the commissioning agencies should automatically consider the confidentiality of the information it is proposed to disclose, and seek the consent of the patient to disclosure of the relevant confidential information for the purposes of the inquiry. If such consent is not forthcoming, the commissioning …
south_east
Independent investigation: Jayne Poppy, Leigh on Sea (2002) — Rec 15
The Trust should ensure that there is a system in place for ensuring that the Trust obtains legal advice on issues of client confidentiality where the client's consent to disclosure cannot be obtained.
east_of_england
Independent investigation: Janet Keegan, Enfield & Harringay (1997) — Rec 19
The Trust and Haringey Council should implement a joint confidentiality policy as a matter of priority.
london
Independent investigation: Gwendoline SmithDavid Smith, Sandiacre (1995) — Rec 35
The limits of confidentiality between the various professionals concerned with a patient's care should be carefully defined, indicating the circumstances in which others must be informed.
midlands
Independent investigation: Claire Wilson (& unborn baby), Grimsby (2009) — Rec R16
NAViGO should ensure all information given to service users by each department about confidentiality and data protection complies with national and local policy and does not conflict with NAViGO‟s clinical and managerial responsibilities. [see paragraphs 13.17, 13.51]
north_east_yorkshire
Independent investigation: Beatrice Hughes, Harrow (1997) — Rec b.
Harrow Council and Harrow & Hillingdon Healthcare Trust ensure that service user consent is encouraged for information sharing between the mental health services and housing services, particularly to facilitate notification of change of personal circumstances;
london
Independent investigation: Anastasia Voykina, Streatham (2012) — Rec 12
The Trust must provide clearer guidance to staff on obtaining information from family members when there is no consent from the service user, but the service user is presenting with behaviour that is a risk to themselves or others. The Trust must also provide guidance to staff on obtaining collateral …
london
The Christie NHS Foundation Trust Rapid Review: Published November 2021 — Rec 2.3.2.1
That the Trust should review its policies and processes related to database access
Christie NHS Foundation Trust
north_west
Independent investigation into the care and treatment provided to Ms … — Rec Recommendation 9
Legal clarification should be sought by the Trust (in conjunction with its multiagency partners) regarding patient rights in relation to confidentiality and reporting on to other statutory agencies. This guidance is of particular relevance to those women who fall ‘sub’ current MARAC, Vulnerable Adult and Safeguarding processes.
Ms X and her son who died in September 2014. Ms X had received care from Berkshire Healthcare NHS Foundation Trust
south_east
Independent investigation into the care and treatment provided to Ms … — Rec Recommendation 14
The Trust must establish (with support from the Clinical Commissioning Groups) a revised interpreter service in order to ensure that no person subject to Forced Marriage or Honour-Based Abuse issues has to use a family member, a member of their local community, or anyone who could be seen to potentially …
Ms X and her son who died in September 2014. Ms X had received care from Berkshire Healthcare NHS Foundation Trust
south_east
Independent investigation into the care and treatment provided to Ms … — Rec Recommendation 13
Current advocacy services should be reviewed and steps taken to ensure that each service can provide specialists in Forced Marriage and Honour-Based Abuse. Steps should also be taken to ensure that these advocates are not drawn from local communities in order to maintain confidentiality and privacy. The Local Authority to …
Ms X and her son who died in September 2014. Ms X had received care from Berkshire Healthcare NHS Foundation Trust
south_east
Independent investigation into the care and treatment provided to Ms … — Rec Recommendation 12
Clear Trust guidance will be developed in relation to the confidentially and privacy needs of women like Ms X. Currently national guidance recommends that carers and families are always involved in full. New guidance needs to provide direction for health and social care professionals who have to navigate a complex …
Ms X and her son who died in September 2014. Ms X had received care from Berkshire Healthcare NHS Foundation Trust
south_east
Assurance Review: Recommendations for commissioners, NHS England, advisors and regulators — Rec 59
Examine ways in which confidential patient information is appropriately anonymised for the purposes of employment tribunal hearings. Guidelines should include: • advice to healthcare professionals on the use of patient information in these proceedings in line with Good Medical Practice guidance and GMC guidance on the use of personal information; …
University Hospitals of Morecambe Bay NHS Foundation Trust
north_west
An Independent Investigation into the adequacy of previous hospital-level investigations … — Rec 6
Data Processing Agreements should be put in place for any and all information sharing during the Phase 2 review.
north_west
Independent investigation into the care and treatment of Mr E: … — Rec 6
The authors of SI reports and the Trust must ensure that information gathered as part of an investigation is securely stored for future reference.
Northumberland, Tyne and Wear NHS Foundation Trust
north_east_yorkshire
Accepted
Independent external quality assurance review following the independent investigation into … — Rec 18
To consider what protocols if any, within the current legislative framework can be developed and implemented to share relevant healthcare information about prisoners at risk of mental health problems who refuse consent to share information with GPs.
midlands
Accepted
Independent investigation: Katie Kazmi, Reading (1999) — Rec 15
Trusts and social services should ensure that there are policies on, and staff training in, the subject of appropriate disclosure of confidential information.
south_east
Independent investigation: Katie Kazmi, Reading (1999) — Rec 13
Trusts should ensure that there are policies on, and staff training in, the subject of appropriate disclosure of confidential information.
south_east
Independent investigation: John West, Sheringham Norfolk (2004) — Rec 15
The panel recommends that the minutes of the CMHT should be formatted so that notes on individual patients can be separated and filed appropriately without compromising the Data Protection Act 1998 within three months. (Paragraph 7.12)
east_of_england
Independent investigation: Tyler Warmington, Faringdon, Oxon (2017) — Rec 7.4
We recommend that NHS England consider with Health Education England the scope to strengthen guidance for those with responsibility for pre-registration training of NHS staff regarding their legal and professional responsibilities in law (MHA, Data Protection, NHS Constitution) to protect patients’ privacy and the confidentiality of their medical information which …
south_east
Independent investigation: Sindi Smith (SS), Stratford. London — Rec R25
There should be a clear policy statement from a pan-London alliance that confidentiality will be respected, information will only be shared when it is either in the best interests of the individual or there is concern for public protection and information will only be used for the purposes for which …
london
Independent investigation: Robert Newby, Sticklepath (2007) — Rec 5
The Trust must commission/complete a review of clinical records and their storage against the standards cited in the Data Protection Act. All clinical areas must ensure that records have been returned to the central archive when patients are discharged or move through services. An audit needs to be conducted in …
south_west
Independent investigation: Patrick Clarke, South Croydon (2016) — Rec 1
The Community Hospital - To undertake a review using a methodology such as 'Quality Improvement' to ensure that the vision, purpose and day to day operation of the hospital and flats is integrated and well understood by all who work there, in particular ward based nurses, this should include:- • …
london
Independent investigation: Geraldine Sureda(Mrs S), Mitcham Park, Merton (2000) — Rec 13
There should be a separate section in each patient’s notes for third party information in order to protect the confidentiality of the informant
london
Independent investigation into the care and treatment provided to Ms … — Rec Recommendation 4
All service users who are considered for informal admission should: Have their capacity to consent to treatment assessed and recorded. Ensure that all assessments for women such as Ms X be conducted in private with no family or community members present. Ensure that If any aspect of …
Ms X and her son who died in September 2014. Ms X had received care from Berkshire Healthcare NHS Foundation Trust
south_east
Independent investigation into the care and treatment provided to Ms … — Rec Recommendation 11
The Trust will make available a resource pack for health and social care professionals. This pack will contain national guidance, Trust advisor contact details and national signposting organisations. Advice and guidance will also be developed to ensure Trust staff does not breach any confidentiality or privacy codes.
Ms X and her son who died in September 2014. Ms X had received care from Berkshire Healthcare NHS Foundation Trust
south_east
Independent investigation into the care and treatment of Mr X … — Rec Recommendation Six
The lessons for learning workshop discussed at length the issues around information sharing between agencies, particularly between health and hostels. The group decided that a core set of information should be agreed between the agencies and that this should form a recommendation. The recommendation should address issues pertaining to patient …
london
Independent investigation: Simon Breed, Wood Green (2004) — Rec R8
The trust immediately reviews the way in which all records (both electronic and paper) are secured following the occurrence of any serious incident to ensure there is no recurrence of the loss of vital clinical information.
london
Independent investigation: Joan Smythe, Rainham (but SE Coast patient) (2002) — Rec 20.2.g
Procedures and information systems. Mental health services should develop clear policies and procedures relating to their interface with MAPPA. Mental health services may consider developing systems to ensure that without breaching confidentiality, patients known to both mental health and probation services can be identified and so managed safely.
south_east
Independent investigation: Terry Radford, Mansfield Woodhouse (2019) — Rec Recommendation 3
Within six months the healthcare team should review its operational policy and processes in relation to information sharing to ensure that care planning and risk assessment are routinely informed by all available information within the constraints of the patient’s right to privacy. This must include ensuring staff understand when they …
midlands
Independent investigation: Ms B, Cheltenham (2008) — Rec 3
The Trust should ensure that staff are aware of their responsibility to communicate potential risk information and the conditions in which confidentiality restrictions should be overridden.
south_west
Joint Domestic Homicide Review and independent mental health homicide investigation … — Rec 26
NHS England should share the learning with the First Tier Tribunal (Mental Health) about parricide and risk to family members, and how sensitive third-party information is managed.
north_west
Independent investigation: Gwendoline SmithDavid Smith, Sandiacre (1995) — Rec 31
Building on the varying rules and practice of the various professional bodies in counselling, clear rules should be promulgated by the Health Authority, setting out for counsellors the basic standards expected. Clarity of the rules as to the sharing of information is crucially important.
midlands
Independent investigation: Dorothy Shepherd, Winchcombe (2010) — Rec 3
The Trust should ensure that staff are aware of their responsibility to communicate potential risk information and the conditions in which consent to share and confidentiality restrictions should be overridden.
south_west
Independent investigation: Dorothy Shepherd, Winchcombe (2010) — Rec 2
The Trust should review the Consent to Share process and ensure that all care coordinators and lead professionals are competent in its use.
south_west
Independent investigation: Bryan Bennett, Newham (1994) — Rec None
housing authorities and housing associations must have a policy on confidentiality which enables transmission of personal confidential information on the basis of ‘need to know’ for the purposes of determining suitable hosing allocation, and for the subsequent protection of service users, staff, and members of the public.
london
Independent care and treatment review into the care and treatment … — Rec 1
Each NHS Trust should review the manner in which it shares patient information with external investigators. Consideration should also be given to the implications of sharing such documentation with other third parties e.g. families and other Trusts. Patient information should be provided in a clear, structured manner that can be …
midlands
Assurance Review: Recommendations for commissioners, NHS England, advisors and regulators — Rec 34
NHS England and NHS Improvement should decide whether more guidance is needed in relation to the uses and retention of email correspondence (or other electronic communications) as part of health records and any regional or national implications of recommendation 9 above.
University Hospitals of Morecambe Bay NHS Foundation Trust
north_west
Independent investigation into the care and treatment of Patient R: … — Rec 6
The Trust should consider whether, when a service user is known to have a particularly peripatetic lifestyle and there are significant concerns about risk, contact should be made with appropriate mental health trusts to share information (with due regard to guidance on confidentiality).
5 Boroughs Partnership NHS Foundation Trust
north_west
Accepted
Independent investigation into the care and treatment of P in … — Rec 18
To consider what protocols if any, within the current legislative framework can be developed and implemented to share relevant healthcare information about prisoners at risk of mental health problems who refuse consent to share information with GPs.
midlands
Accepted
An independent investigation into the care and treatment of service … — Rec Recommendation 3
Within six months the healthcare team should review its operational policy and processes in relation to information sharing to ensure that care planning and risk assessment are routinely informed by all available information within the constraints of the patient’s right to privacy. This must include ensuring staff understand when they …
midlands
Themes and lessons learnt from NHS investigations into matters relating … — Rec R9
All NHS hospital trusts should devise a robust trust-wide policy setting out how access by patients and visitors to the internet, to social networks and other social media activities such as blogs and Twitter is managed and where necessary restricted. Such policy should be widely publicised to staff, patients and …
national
Accepted
Detention investigations(1)
Independent reviews(50)
Fisher Review (Part 1) — Rec 26
That the Criminal Procedure Rules be amended so that the following factors are considered when deciding whether to grant permission for the making of a late application under section 8 of the CPIA: a. If the material requested is necessary for a fair trial. b. The disclosure of the material …
Justice & Legal
Accepted
Fisher Review (Part 1) — Rec 5
Undertake a review of law enforcement and local police force access to secure platforms for the sharing of sensitive material.
Justice & Legal
Accepted
Penrose Competition Review — Rec 15
CMA should continue this work, potentially by extending its initial market study into a full-scale market investigation in future, to improve transparency of the price consumers are paying through their data for digital goods and services, so they can make informed choices about whether each one represents good value or …
Other
Pickles Electoral Fraud Review — Rec R17
The Government should investigate the development of a facility in the IER Digital Service to retain the IP address used to make applications. This should be subject to a rigorous cost/benefit analysis to ensure that that such an approach would be of genuine value to law enforcement.
Other
Caldicott Review 2016 — Rec 19
The Department of Health should conduct a full and comprehensive formal public consultation on the proposed standards and opt-out model. Alongside this consultation, the opt-out questions should be fully tested with the public and professionals.
Health & Social Care
Caldicott Review 2016 — Rec 16
The Department of Health should look at clarifying the legal framework so that health and social care organisations can access the information they need to validate invoices, only using personal confidential data when that is essential.
Health & Social Care
Caldicott Review 2016 — Rec 14
The forthcoming Information Governance Alliance's guidance on disseminating health and social care data should explicitly refer to the potential legal, financial, and reputational consequences of organisations failing to have regard to the ICO's Anonymisation Code of Practice by re-identifying individuals.
Health & Social Care
Caldicott Review 2016 — Rec 13
The Government should consider introducing stronger sanctions to protect anonymised data. This should include criminal penalties for deliberate and negligent re-identification of individuals.
Health & Social Care
Caldicott Review 2016 — Rec 11
There should be a new consent/opt-out model to allow people to opt out of their personal confidential data being used for purposes beyond their direct care. This would apply unless there is a mandatory legal requirement or an overriding public interest.
Health & Social Care
Caldicott Review 2016 — Rec 9
Where malicious or intentional data security breaches occur, the Department of Health should put harsher sanctions in place and ensure the actions to redress breaches proposed in the 2013 Review are implemented effectively.
Health & Social Care
Caldicott Review 2013 — Rec 25
The Review Panel recommends that the revised Caldicott principles should be adopted and promulgated throughout the health and social care system.
Health & Social Care
Caldicott Review 2013 — Rec 23
The health and social care system requires effective regulation to ensure the safe, effective, appropriate and legal sharing of personal confidential data. This process should be balanced and proportionate and utilise the existing and proposed duties within the health and social care system in England. The three minimum components of …
Health & Social Care
Caldicott Review 2013 — Rec 21
The Health and Social Care Information Centre's Code of Practice for processing personal confidential data should adopt the standards and good practice guidance contained within this report.
Health & Social Care
Caldicott Review 2013 — Rec 19
All health and social care organisations must publish in a prominent and accessible form: • a description of the personal confidential data they disclose; • a description of the de-identified data they disclose on a limited basis; • who the disclosure is to; and • the purpose of the disclosure.
Health & Social Care
Caldicott Review 2013 — Rec 16
Given the number of social welfare initiatives involving the creation or use of family records, the Review Panel recommends that such initiatives should be examined in detail from the perspective of Article 8 of the Human Rights Act. The Law Commission should consider including this in its forthcoming review of …
Health & Social Care
Caldicott Review 2013 — Rec 11
The Information Centre's code of practice should establish that an individual's existing right to object to their personal confidential data being shared, and to have that objection considered, applies to both current and future disclosures irrespective of whether they are mandated or permitted by statute. Both the criteria used to …
Health & Social Care
Caldicott Review 2013 — Rec 10
The linkage of personal confidential data, which requires a legal basis, or data that has been de-identified, but still carries a high risk that it could be re-identified with reasonable effort, from more than one organisation for any purpose other than direct care should only be done in specialist, well-governed, …
Health & Social Care
Caldicott Review 2013 — Rec 9
The rights, pledges and duties relating to patient information set out in the NHS Constitution should be extended to cover the whole health and social care system.
Health & Social Care
Caldicott Review 2013 — Rec 8
Consent is one way in which personal confidential data can be legally shared. In such situations people are entitled to have their consent decisions reliably recorded and available to be shared whenever appropriate, so their wishes can be respected. In this context, the Informatics Services Commissioning Group must develop or …
Health & Social Care
Caldicott Review 2013 — Rec 7
All organisations in the health and social care system should clearly explain to patients and the public how the personal information they collect could be used in de-identified form for research, audit, public health and other purposes. All organisations must also make clear what rights the individual has open to …
Health & Social Care
Caldicott Review 2013 — Rec 6
The processing of data without a legal basis, where one is required, must be reported to the board, or equivalent body of the health or social care organisation involved and dealt with as a data breach. There should be a standard severity scale for breaches agreed across the whole of …
Health & Social Care
Caldicott Review 2013 — Rec 5
In cases when there is a breach of personal confidential data, the data controller, the individual or organisation legally responsible for the data, must give a full explanation of the cause of the breach with the remedial action being undertaken and an apology to the person whose confidentiality has been …
Health & Social Care
Caldicott Review 2013 — Rec 3
The health and social care professional regulators must agree upon and publish the conditions under which regulated and registered professionals can rely on implied consent to share personal confidential data for direct care. Where appropriate, this should be done in consultation with the relevant Royal College. This process should be …
Health & Social Care
Caldicott Report 1997 — Rec Principle 6
Understand and comply with the law Every use of patient identifiable information must be lawful. Someone in each organisation handling patient information should be responsible for ensuring that the organisation complies with legal requirements.
Health & Social Care
Caldicott Report 1997 — Rec Principle 5
Everyone with access to patient identifiable information should be aware of their responsibilities Action should be taken to ensure that those handling patient identifiable information — both clinical and non-clinical staff – are made fully aware of their responsibilities and obligations to respect patient confidentiality.
Health & Social Care
Caldicott Report 1997 — Rec Principle 4
Access to patient identifiable information should be on a strict need-to-know basis Only those individuals who need access to patient identifiable information should have access to it, and they should only have access to the information items that they need to see. This may mean introducing access controls or splitting …
Health & Social Care
Caldicott Report 1997 — Rec Principle 3
Use the minimum necessary patient-identifiable information Where use of patient identifiable information is considered to be essential, the inclusion of each individual item of information should be considered and justified so that the minimum amount of identifiable information is transferred or accessible as is necessary for a given function to …
Health & Social Care
Caldicott Report 1997 — Rec Principle 2
Don't use patient identifiable information unless it is absolutely necessary Patient identifiable information items should not be included unless it is essential for the specified purpose(s) of that flow. The need for patients to be identified should be considered at each stage of satisfying the purpose(s).
Health & Social Care
Caldicott Report 1997 — Rec Principle 1
Justify the purpose(s) Every proposed use or transfer of patient identifiable information within or from an organisation should be clearly defined and scrutinised, with continuing uses regularly reviewed, by an appropriate guardian.
Health & Social Care
Bean Economic Statistics Review — Rec D10
Recommended Action 10: Remove obstacles to the greater use of public sector administrative data for statistical purposes, including through changes to the associated legal framework, while ensuring appropriate ethical safeguards are in place and privacy is protected.
Other
Bean Economic Statistics Review — Rec D
Strategic Recommendation D: Make the most of existing and new data sources and the technologies for dealing with them Remove obstacles to the greater use of public sector administrative data for statistical purposes, including through changes to the associated legal framework, while ensuring appropriate ethical safeguards are in place and …
Other
Goldacre Review — Rec IG 23
Start an overdue public discussion about commercial access TREs make a profound contribution to commercial work with NHS data, because they completely separate two distinct issues: the protection of patients’ privacy; and the wider ethical and political judgement about the appropriateness of commercial access. However, while addressing the issue of …
Health & Social Care
Goldacre Review — Rec IG 18
Produce boiler-plate templates for patient consent for data use and dissemination There will be certain circumstances where it may be necessary to provide local downloads of patient data, for example, for patient follow up in clinical trials. In these circumstances the patients must have given explicit consent for their data …
Health & Social Care
Goldacre Review — Rec IG 16
Disclose all data flows leaving NHS organisations in one place Throughout this review we have received detailed descriptions of many substantial bulk flows of NHS patient data for service research and research, including complete patient records, outside of local NHS and associated organisations, including GP practices, on the basis of …
Health & Social Care
Goldacre Review — Rec IG 15
Appropriately sanction those who are caught deliberately and maliciously attempting to re-identify individuals in patient records There are numerous accounts of people inappropriately accessing fully identifiable records without consent or legal basis, or otherwise misusing patient records. When this happens - in the case of, for example, celebrities being admitted …
Health & Social Care
Goldacre Review — Rec IG 13
Revise the definitions of “anonymous” “identifiable” and “linked” data; add a new category of “pseudonymised but re-identifiable” There has been a widespread misapprehension across the system around pseudonymised data, and an excessive confidence in the privacy protections provided by the removal of direct identifiers. This misunderstanding has been pivotal in …
Health & Social Care
Goldacre Review — Rec IG 12
Uphold the commitment that the NHS Digital GPDPR dataset will not be disseminated This dataset is unprecedented in detail and coverage, it cannot be meaningfully pseudonymised by the removal of direct identifiers. It is very welcome that this data will now only be accessible in a TRE. It is critical …
Health & Social Care
Goldacre Review — Rec IG 11
Review the National Data Opt Out Policy after TREs are established The National Data Opt Out policy was introduced in response to the crisis in public trust caused by the problematic implementation of care.data in 2013. It has, however, been problematic in implementation, inconsistently applied, and can give patients the …
Health & Social Care
Goldacre Review — Rec IG 9
Create a 2-track approval system to incentivise use of TREs The current complex IG arrangements were principally devised to manage the privacy risks that are inherent to more insecure methods of data analysis through dissemination, where there is a greater risk that data could be leaked, illegally viewed, or otherwise …
Health & Social Care
Goldacre Review — Rec TRE 56
Exceptions to TRE usage Following the announcement that the GP data extract will only be available in a TRE, some groups began to request exceptions from this rule. Two substantive exceptions to TRE usage are reasonable to consider. Consented cohorts Where participants have already given a very large amount of …
Health & Social Care
Goldacre Review — Rec TRE 40
Academics should use NHS data infrastructure to access NHS patient records All academic work on NHS patient records alone should always be conducted in NHS TREs, and be compliant with RAP and open working methods. Patient data should only be transferred out to other non-NHS data centres when that patient …
Health & Social Care
Goldacre Review — Rec TRE 39
Work towards audits and registries using national NHS infrastructure, RAP, and TREs The ultimate destination should be that all such datasets are held in one of the national TREs for NHS data, in particular because these projects often involve using patient data without explicit opt-in consent (in contrast to many …
Health & Social Care
Goldacre Review — Rec TRE 32
Work towards federated analytics with standard local TREs “Federated analytics” is a secure approach to executing data analysis against locally held datasets in situ, without extracting all local data to a central repository. At its best, a single set of instructions for data management and analysis are written in one …
Health & Social Care
Goldacre Review — Rec TRE 22
No special cases for working outside a TRE Since the announcement that the planned GP Data for Planning and Research data collection will be TRE-only some organisations have been arguing that they should be regarded as an exception. There is no reason why a TRE cannot meet all users’ needs. …
Health & Social Care
Goldacre Review — Rec TRE 20
Publish all technical steps taken to prevent and detect misuse of data All TREs must take technical steps to prevent and detect misuse of patients’ data, such as by obfuscating access to raw data; and disclose these technical methods openly. Ensuring National TREs are Accessible, and Used
Health & Social Care
Goldacre Review — Rec TRE 18
Switch off data disseminations, without undue panic There is no need for potentially re-identifiable disclosive data at national scale to flow outside of secure environments. TREs are the only way to build public trust and get larger numbers of people working on NHS data for innovation, service improvement and research. …
Health & Social Care
Goldacre Review — Rec TRE 17
Create clear rules for undeclared analyses in TREs A concern has been raised that sometimes there is a legitimate need for certain users to conduct certain forms of data analysis discreetly, without openly declaring their activity at the time. This is a reasonable user need in certain circumstances. However, this …
Health & Social Care
Goldacre Review — Rec TRE 16
All TREs must share live detailed activity logs These should openly disclose, at minimum: the individual executing code; a link to the documentation for their legal basis to process the data; the datasets against which code is being executed; and ideally the data management and analysis code itself, as this …
Health & Social Care
Goldacre Review — Rec TRE 15
Ensure TRE access is faster and easier than data dissemination TREs are lower risk than data dissemination. They present a range of safeguards that substantially increase patient privacy, and prevent analyses outside of those permitted, by sharing information about all activity in the platform, and by using tools that obstruct …
Health & Social Care
Goldacre Review — Rec TRE 13
Create a national standard approach to “output checking” and support automation All results tables and graphs leaving TREs under best practice must currently go through manual “output checking” to ensure no disclosive material is accidentally released: this is time consuming and implementation is variable. The National TRE team should develop …
Health & Social Care
PHSO casework decisions(18)
P-002284 — Midlands Partnership NHS Foundation Trust
Miss R complained a mental health nurse shared private health information with her employer without consent, causing harassment and mental distress.
NHS in England
Nov 2023
P-001489 — An Inpatient Service in the Darlington area
Mr I complained the Inpatient Service disclosed his personal health records without consent and incorrectly recorded his treatment, causing psychological injury and financial loss.
NHS in England
Aug 2022
P-002878 — HM Courts and Tribunals Service
Mr W complained HMCTS shared his personal data via an Attachment of Earnings Order with a company he never worked for, causing significant mental distress.
UK Government
Aug 2024
P-003818 — Lincolnshire Community Health Services NHS Trust
Mr and Mrs A complained a nurse improperly accessed their records for non-clinical reasons, the Trust failed to restrict Mr A's records, and their complaint was not properly investigated.
NHS in England
Sep 2023
P-002301 — A practice in the Brighton and Hove area
Ms G complained the Practice inappropriately revealed historical, sensitive, and partly incorrect personal information to a fostering agency without her consent, causing her and her family stress.
NHS in England
Nov 2023
P-002661 — Derbyshire Healthcare NHS Foundation Trust
Mr P complained the Trust inappropriately shared his personal and medical information with the council without his consent, causing him embarrassment and distress.
NHS in England
Jun 2024
P-004590 — Wrightington, Wigan and Leigh Teaching Hospitals NHS Foundation …
Mrs Y complained the Trust mishandled her brother's care by sharing other patients' data, confusing his surgery consent, and failing a gallbladder removal, delaying proper treatment.
NHS in England
Jan 2026
P-001664 — Primary Care Support England
Miss O complained Primary Care Support England (PCSE) redacted sections of her medical records before releasing them to her.
NHS in England
Dec 2022
P-004253 — Information Commissioner's Office
Mr B complained the ICO failed to satisfactorily investigate his data handling concerns, including not using a three-part test for Legitimate Interest and not addressing his raised issues.
UK Government
Nov 2025
P-004393 — A practice in the City of Leicester area
Miss Y complained the Practice shared her sensitive personal data without consent and failed to acknowledge her communications or accept responsibility.
NHS in England
Dec 2025
P-001262 — A medical practice in the Leicester area
Miss A complained the Practice breached her confidentiality by disclosing sensitive information to third parties against her explicit wishes, causing distress and flashbacks.
NHS in England
Jan 2022
P-004258 — Information Commissioner's Office
Mr E complained the ICO failed its regulatory duties regarding ANPR surveillance, specifically concerning inaccurate data and not scrutinising a National Data Protection Impact Assessment.
UK Government
Nov 2025
P-004620 — HM Courts and Tribunals Service
Mr U complained HMCTS wrongly disclosed his email address to a claimant, leading to harassment and severe impact on his and his wife's mental health and quality of life.
UK Government
Jan 2026
P-002292 — Gloucestershire Hospitals NHS Foundation Trust
Trust failed to follow Mr I's advance decision, misdiagnosed a seizure as a fall, and shared his health information with the DVLA without consent.
NHS in England
Nov 2023
P-002645 — North Staffordshire Combined Healthcare NHS Trust
Ms H complained the Trust discharged her from mental health support without investigating root causes or arranging a care plan. She also alleged a data breach involving a lost sensitive statement.
NHS in England
May 2024
P-003740 — A practice in the Cheshire West and Chester …
Miss I complained that three practices removed diagnoses, shared her medical information, tampered with records, and failed to upload them electronically between 1981 and 2005. She alleged this led to her not knowing about a genetic condition.
NHS in England
Aug 2025
P-004528 — A practice in the Derbyshire Dales area
Mr C complained the Practice sent contradictory court letters, delayed a medical report, shared his private records, wrongly removed him from its list, and mishandled his complaint.
NHS in England
Dec 2025
P-002559 — Child Maintenance Service (CMS)
Miss A complained on behalf of Mr O that CMS failed to consider another child in maintenance calculations, used incorrect HMRC data, breached data protection, and incorrectly debited arrears. He sought apology and recalculation.
UK Government
Apr 2024
LGO / SPSO decisions(281)
25-005-567 — Sandwell Metropolitan Borough Council
Summary: We will not investigate Miss X’s complaint about the Council not responding to her subject access request. It is more appropriate for the Information Commissioner’s Office to consider her complaint.
LGO (Local Government & …
Other Categories
Jul 2025
25-004-384 — Leicestershire County Council
Summary: We will not investigate Mr X’s complaint about how the Council has dealt with his subject access requests and his requests for information to be amended. The Information Commissioner is better placed to deal with these matters.
LGO (Local Government & …
Other Categories
Jul 2025
25-003-873 — Sunderland City Council
Summary: We will not investigate Mr X’s complaint that the Council used inaccurate information to justify issuing him with a Community Protection Warning. This is because there is no worthwhile outcome, and the Information Commissioner is better placed to deal with part of Mr X’s complaint about data protection.
LGO (Local Government & …
Other Categories
Jul 2025
25-007-980 — Middlesbrough Borough Council
Summary: We will not investigate Ms X’s complaint about an alleged breach of her personal data. The Information Commissioner’s Office is better placed to consider this complaint.
LGO (Local Government & …
Other Categories
Jul 2025
25-009-787 — City of York Council
Summary: We will not investigate Mrs B’s complaint that the Council wrongly sent her sensitive personal information relating to someone else. This is because Mrs B may complain to the Information Commissioner’s Office which is in the best position to consider this complaint.
LGO (Local Government & …
Other Categories
Aug 2025
21-015-453 — Bracknell Forest Council
Summary: We will not investigate this complaint that the Council wrongly shared Mr X’s personal information with third parties as this is a matter for the Information Commissioner’s Office.
LGO (Local Government & …
Other Categories
Feb 2022
21-007-850 — Surrey County Council
Summary: There was fault by the Council in record keeping and handling sensitive data and this caused Mr X avoidable distress. The Council will apologise, pay him £500, erase a letter and arrange training for staff.
LGO (Local Government & …
Adult Care Services
Upheld
Feb 2022
21-016-771 — Folkestone & Hythe District Council
Summary: We will not investigate this complaint that the Council wrongly sent Ms X’s confidential information to the wrong address as this is a matter for the Information Commissioner Office.
LGO (Local Government & …
Other Categories
Feb 2022
21-015-257 — Oxfordshire County Council
Summary: We uphold Mrs Y’s complaint, as the Council breached data protection obligations about Mrs Y’s child. The Council has agreed to pay £200 to Mrs Y to recognise the emotional impact of the fault.
LGO (Local Government & …
Other Categories
Upheld
Mar 2022
21-018-536 — Lincoln City Council
Summary: We will not investigate this complaint about a data breach by the Council and the compensation it has offered. This is because the Information Commissioner’s Office is better placed to consider it, and the complainant may go to court if they seek financial compensation.
LGO (Local Government & …
Benefits And Tax
Mar 2022
22-003-008 — Stoke-on-Trent City Council
Summary: Mr X complains about the Council’s handling of sensitive information and its data gathering techniques. We will not investigate the complaint because the Council addressed his complaint in the way he had asked and if he has concerns about a data breach, the Information Commissioner is the body best …
LGO (Local Government & …
Environment And Regulation
Jun 2022
22-004-393 — City of Bradford Metropolitan District Council
Summary: We will not investigate Mrs X’s complaint the Council committed a data breach by sharing her sensitive personal information with third parties. This is because complaints about data matters such as this are best considered by the Information Commissioner’s Office.
LGO (Local Government & …
Other Categories
Jul 2022
22-006-082 — Blackburn with Darwen Council
Summary: We will not investigate this complaint about data protection issues. This is because the complaint does not meet the tests in our Assessment Code on how we decide which complaints to investigate. The Information Commissioner’s Office is best placed to deal with this complaint.
LGO (Local Government & …
Transport And Highways
Aug 2022
22-005-844 — West Northamptonshire Council
Summary: We will not investigate Mr X’s complaint about a data breach by the Council. This is because complaints about data matters, such as this, are best considered by the Information Commissioner’s Office.
LGO (Local Government & …
Other Categories
Aug 2022
22-009-269 — Nottinghamshire County Council
Summary: We will not investigate this complaint about that the Council committed a data breach by accessing her private information without her consent and sharing it with others. This is because complaints about breaches of data protection regulations are better considered by the Information Commissioner.
LGO (Local Government & …
Children S Care Services
Oct 2022
22-010-035 — London Borough of Hillingdon
Summary: We will not investigate this complaint about how the Council dealt with the complainant’s request for information. This is because this matter is best dealt with by the Information Commissioner’s Office.
LGO (Local Government & …
Other Categories
Oct 2022
22-009-829 — Luton Borough Council
Summary: We will not investigate this complaint about the Council disclosing the complainant’s personal details. This is because this matter is best dealt with by the Information Commissioner’s Office.
LGO (Local Government & …
Other Categories
Oct 2022
22-009-669 — Bournemouth, Christchurch and Poole Council
Summary: We will not investigate this complaint about a breach of data protection. It is reasonable for the complainant to ask the Information Commissioner’s Office to consider his concerns.
LGO (Local Government & …
Other Categories
Nov 2022
23-020-787 — Nottinghamshire County Council
Summary: We will not investigate this complaint that the Council released confidential data during a meeting. This is because this is best dealt with by the Information Commissioner's Office.
LGO (Local Government & …
Children S Care Services
Mar 2024
23-020-772 — London Borough of Brent
Summary: We will not investigate this complaint that the Council sent Miss X’s confidential data to a third party. This is because this is best dealt with by the Information Commissioner's Office.
LGO (Local Government & …
Other Categories
Mar 2024
24-007-822 — West Northamptonshire Council
Summary: We will not investigate this complaint about an alleged data breach as this is best dealt with by the Information Commissioner’s Office.
LGO (Local Government & …
Other Categories
Aug 2024
24-008-659 — Medway Council
Summary: We will not investigate Mr X’s complaint about a data breach. This is because complaints about data matters, such as this, are best considered by the Information Commissioner’s Office.
LGO (Local Government & …
Other Categories
Sep 2024
24-021-524 — Sefton Metropolitan Borough Council
Summary: We will not investigate Mr X’s complaint about a personal data breach. This is because complaints about data matters, such as this, are best considered and decided by the Information Commissioner’s Office.
LGO (Local Government & …
Children S Care Services
Apr 2025
24-020-876 — Westminster City Council
Summary: We will not investigate Mr X’s complaint that the Council unlawfully processed and shared his personal data. This is because the Information Commissioner’s Office is better placed to consider this complaint. We will not investigate Mr X’s complaint about the Council’s complaint process because it does not meet the …
LGO (Local Government & …
Other Categories
Apr 2025
24-022-141 — Cambridge City Council
Summary: We will not investigate Mr X’s complaint that the Council breached data protection regulations in its handling of a housing application. This is because the Information Commissioner is better placed to consider the issues raised.
LGO (Local Government & …
Other Categories
May 2025
25-002-519 — London Borough of Hounslow
Summary: We will not investigate Mr X’s complaint about the Council’s use of a photo of his children without his permission. This is because this is a complaint about a data matter which is best considered and decided by the Information Commissioner’s Office.
LGO (Local Government & …
Other Categories
Jun 2025
24-022-928 — London Borough of Newham
Summary: We will not investigate this complaint about the Council sharing confidential information with a third party or the complainant’s concerns about a penalty charge notice. This is because the complainant has not suffered significant personal injustice and parts of the complaint are best dealt with by the Information Commissioner’s …
LGO (Local Government & …
Transport And Highways
Jul 2025
25-003-662 — Stoke-on-Trent City Council
Summary: We will not investigate this complaint about the Council allegedly sharing Mr X’s personal and business information with a third party. The Information Commissioner is best placed to consider how the Council handled Mr X’s data, and the county court is best placed to consider his claim for compensation.
LGO (Local Government & …
Housing
Aug 2025
25-010-838 — Liverpool City Council
Summary: We will not investigate this complaint about the Council’s failure to comply with a ruling made by the Information Commissioner’s Office. This is because this complaint relates to personal data and is a matter best dealt with by the Information Commissioner’s Office.
LGO (Local Government & …
Other Categories
Oct 2025
24-009-688 — London Borough of Croydon
Summary: We will not investigate Ms X’s complaint about a data breach by the Council because the Information Commissioner’s Office is better placed to deal with that complaint. We will not investigate the complaint about the steps the Council took after the data breach was identified because we could not …
LGO (Local Government & …
Education
Nov 2024
24-011-715 — London Borough of Barnet
Summary: We will not investigate this complaint about the Council’s response to Ms X’s subject access requests under the GDPR legislation and its use of her personal data. This is because the Information Commissioner’s Office is best placed to deal with such issues.
LGO (Local Government & …
Other Categories
Nov 2024
21-014-304 — London Borough of Hackney
Summary: We will not investigate this complaint about the loss and misuse of data. Miss X has a right to go to court it would be reasonable to use.
LGO (Local Government & …
Children S Care Services
Jan 2022
21-016-558 — Malvern Hills District Council
Summary: We will not investigate this complaint about an alleged data breach by the Council as this is a matter for the Information Commissioner’s Office.
LGO (Local Government & …
Other Categories
Feb 2022
21-017-672 — Barnsley Metropolitan Borough Council
Summary: We will not investigate this complaint about a data protection breach as this is best dealt with by the Information Commissioner’s Office.
LGO (Local Government & …
Other Categories
Mar 2022
22-001-970 — London Borough of Redbridge
Summary: We will not investigate this complaint about how the Council responded when it sent Mr X information about another person. There is another body better placed to consider this complaint and Mr X was not caused an injustice as a result of the Council’s actions.
LGO (Local Government & …
Other Categories
May 2022
22-002-272 — North Lincolnshire Council
Summary: We will not investigate this complaint about the Council disclosing personal details. This is because this matter is best dealt with by the Information Commissioner’s Office.
LGO (Local Government & …
Other Categories
May 2022
22-002-644 — Forget Me Not Residential Home Limited
Summary: We will not investigate this complaint about the Care Provider breaching data protection. This is because breaches of data are normally for the Information Commissioner’s Office to consider, and Mr B has reported these breaches to the ICO.
LGO (Local Government & …
Adult Care Services
Jun 2022
22-004-063 — Huntingdonshire District Council
Summary: We will not investigate this complaint about an alleged data breach by the Council as this is best dealt with by the Information Commissioner’s Office.
LGO (Local Government & …
Other Categories
Jun 2022
22-000-852 — Kent County Council
Summary: Miss X complained the Council published confidential financial information in an assessment for her son’s disability needs, which negatively affected services for him. The Council has already remedied the matter, but we found further fault by the Council in delaying direct payments and delay in dealing with Miss X’s …
LGO (Local Government & …
Children S Care Services
Upheld
Aug 2022
22-007-062 — Chorley Borough Council
Summary: We will not investigate this complaint about the Council publishing the complainant’s personal information on its website. This is because this matter is best dealt with by the Information Commissioner’s Office.
LGO (Local Government & …
Other Categories
Aug 2022
22-007-021 — Charnwood Borough Council
Summary: We will not investigate this complaint about the Council publishing the complainant’s personal information on its website. This is because the complainant has already complained to the Information Commissioner, who is best placed to deal with these matters. It would be reasonable for the complainant to pursue his claim …
LGO (Local Government & …
Planning
Aug 2022
22-003-645 — City of Bradford Metropolitan District Council
Summary: Miss X complained about how the care provider acting on behalf of the Council shared her mother’s personal information with family, decided to end its service and spoke to her father. I have ended my investigation. There is insufficient evidence of significant personal injustice or fault and investigation would …
LGO (Local Government & …
Adult Care Services
Not Upheld
Aug 2022
22-007-090 — Wealden District Council
Summary: We will not investigate this complaint about the Council wrongly including Ms X’s personal information in Council minutes as this is best dealt with by the Information Commissioner’s Office. In addition, as the matter appears to relate to an estate management issue, this matter is likely to be out …
LGO (Local Government & …
Other Categories
Sep 2022
22-008-873 — Newcastle upon Tyne City Council
Summary: We will not investigate this complaint about information the Council passed to Mr X’s employer as the substantive injustice caused to Mr X arose from the action of Mr X’s employer, over whom we have no jurisdiction. In addition, Mr X’s complaint is essentially best dealt with by the …
LGO (Local Government & …
Other Categories
Oct 2022
22-007-070 — Devon County Council
Summary: We will not investigate this complaint about a data breach. This is because complaints about data matters such as this are best considered by the Information Commissioner’s Office.
LGO (Local Government & …
Other Categories
Oct 2022
22-010-474 — Barnsley Metropolitan Borough Council
Mr X complains about the Council breaching his personal data to a third party without seeking his consent. We will not investigate this complaint. This is because it is reasonable for Mr X to complain to the Information Commissioner’s Office as the most appropriate body.
LGO (Local Government & …
Other Categories
Nov 2022
22-009-289 — Ashfield District Council
Summary: We will not investigate this complaint that a visit by the Council to check Mr X’s welfare was a breach of his personal data. That is because there is not enough evidence of fault to justify our involvement.
LGO (Local Government & …
Other Categories
Nov 2022
22-011-993 — Isle of Wight Council
Mrs says the Council breached her personal information resulting in her being attacked. We will not investigate. This is because it is reasonable for Mrs X to complain to the Information Commissioner’s Office as it is better placed to deal with her complaint.
LGO (Local Government & …
Other Categories
Dec 2022
22-008-875 — London Borough of Harrow
Summary: Ms X complains about the Council’s handling of her mother’s blue badge application and data breach by its contractor causing distress. The Information Commissioner has considered the data breach. The Council has accepted it was at fault. It has already apologised and offered a suitable remedy. So, we are …
LGO (Local Government & …
Adult Care Services
Upheld
Dec 2022
23-020-414 — Oldham Metropolitan Borough Council
Summary: We will not investigate Mrs X’s complaint about a data breach by the Council. This is because this is a matter best considered by the Information Commissioner’s Office.
LGO (Local Government & …
Other Categories
Apr 2024
Domestic Homicide Reviews(40)
Tewkesbury — recommendation 17.7.1
There is a need to ensure that written consent from every adult, listed as an applicant on any approach for homeless assistance, is obtained. This is currently the case for all households approaching for statutory homeless assistance, but not for those who do not meet the vulnerability homeless criteria (as …
Gloucester City Council Housing Service
Tewkesbury — recommendation 17.1.2
That CAADA reviews the national training given to IDVAs and to domestic abuse support services relating to the Data Protection Act and the Domestic Violence Disclosure Scheme (Clare’s law).
CAADA
Tewkesbury — recommendation 17.1.1
That the Information Commissioner provides clarification/guidance re the legality of domestic abuse specialist support services being able to retain information relating to perpetrators of domestic abuse, to enable them to provide information, via the police, to safeguard vulnerable new partners of the perpetrators, under Domestic Violence Disclosure Scheme (Clare’s law).
Information Commissioner's Office
Information Commissioner
Kent — recommendation 12
The Criminal Justice Team within Kent Police to identify a means of highlighting the fact that a victim of domestic abuses current address is not placed on the documentation for the CPS and therefore inadvertently read out in court proceedings.
Criminal Justice Team, Kent Police
Swindon — recommendation 1
In this DHR professionals from different organisations made conflicting decisions on whether to share with the police information relating to the victim, without her consent when they believed she was a risk of serious harm or death. Some (including Mental Health Services, and Hospital) ,following the ICO Codes of Practice …
Home Office | Dept of Health …
Home Office
Oxford — recommendation 4
To remind schools about LA guidance relating to sharing personal information and the use of social networks.
Schools and Special Educational Needs
Kingston upon Thames — recommendation 41
Explore whether to advise adults in possible domestic abuse situations to delete emails so that email cannot be read by others
NSPCC
Bromley — recommendation Recommendation 6
Safer Bromley Partnership to only publish the learnings and recommendations as the perpetrator will be released eventually and his confidentiality should be respected.
Safer Bromley Partnership
Bromley — recommendation National recommendat
For the Home Office to provide more guidance for domestic homicide reviews regarding the legal obligation to protect sensitive personal information such as medical information and the obligation to publish domestic homicide reviews.
Home Office
Home Office
Norfolk — recommendation 34
Family members contacting the university with concerns about a student should have explained to them the limitations for sharing personal information about the student, when information can be shared, and the duties this places on the university’s ability to provide detailed feedback. The university should consider producing a pdf leaflet …
University of Manchester
The University of Manchester
South Norfolk — recommendation 17.3
The Home Office considers how to protect the anonymity of the DHR report for small rural communities.
Home Office
Home Office
Nottingham — recommendation 10.4e
All voicemail messages left by GP Practice Staff should be fully documented into the GP Records of the individual concerned AND any messages left for victims of Domestic Abuse should contain only minimal routine information about health appointments and not relate in any way to domestic abuse/domestic abuse information because …
Greater Nottingham Clinical Commissioning Partnership
Preston — recommendation 1
A review of governance of personal data
Lady Elsie Finney House
Kent — recommendation 13.4
In liaison with domestic abuse support providers raise the awareness of the potential misuse of Tracking Apps that are routinely installed on mobile telephones and other devices with potential victims and service providers, the focus to be particularly in terms of Stalking and Harassment. The Kent County Community Safety Partnership …
Kent County Community Safety Partnership | …
Harrow — recommendation 3
All MARAC referrals have information on consent
Hestia
Gwynedd — recommendation 2
That the Acute Mental Health Unit cease using fax machines as a primary means of relaying sensitive and confidential information and instead utilise secure email systems which can password protect confidential information, which can provide a clear audit trail, and which can utilise a send receipt option as a means …
Acute Mental Health Unit
Acute Mental Health Services
Stoke-on-Trent — recommendation UHNM_R6
UHNM to review, with the Principal Officer for MASH, the process for the sharing of patient details with external agencies when the patient does not consent.
University Hospitals of North Midlands NHS …
University Hospitals of North …
Cumbria — recommendation 26
NHS England should share the learning with the First Tier Tribunal (Mental Health) about parricide and risk to family members, and how sensitive third-party information is managed.
NHS England
NHS England
Cumbria — recommendation 15
NHS England should share learning identified with the First Tier Tribunal (Mental Health) regarding providing guidance to families about how any confidential information they share may be used.
NHS England
NHS England
North East Lincolnshire — recommendation 3
Where adults at risk are under services to have recorded contact details of professionals involved in the patient's care; such as the details of an IDVA or social worker. This can be recorded in the safeguarding template on the computer system so is hidden from online access.
North East Lincolnshire Health and Care …
Sheffield — recommendation 7
SCC’s Information Officer is reviewing the privacy notice for applicants approaching SCC as homeless, to review if relevant information can be shared with Housing Staff if that applicant subsequently signs for an SCC tenancy
Sheffield City Council
Sheffield City Council
Carmarthenshire — recommendation 19
Include direction in the revised DHR guidance in respect of the sharing of information relating to individuals in cases where there has been no conviction or consent provided
Home Office
Home Office
Plymouth — recommendation 15
Schools to ensure they review existing data collection systems to ensure that they detail the nationality and religious beliefs of parents and children.
Schools
Kingston upon Thames — recommendation 8
Information sharing and confidentiality embedded in safeguarding training.
South West London and St George’s …
South West London and …
Harlow — recommendation 11.10.2
Must develop appropriate information sharing protocols that can override the barriers caused by separate IT systems, and the laws regarding data protection.
All Agencies
Norfolk — recommendation 34
Family members contacting the university with concerns about a student should have explained to them the limitations for sharing personal information about the student, when information can be shared, and the duties this places on the university’s ability to provide detailed feedback. The university should consider producing a pdf leaflet …
University of Manchester
The University of Manchester
Norfolk — recommendation 32
To bring clarity for staff regarding information sharing procedures when a family member raises concerns for the health and wellbeing of a student, but it is judged the circumstances do not meet the criteria for sharing personal information, the family member should routinely receive a follow-up phone call or email …
University of Manchester
The University of Manchester
Nottingham — recommendation 11.10
Local agencies from the Nottingham Domestic Homicide Review Assurance, Learning and implementation Group (DHR ALIG) should develop Practice Guidance on Multi-agency data sharing to ensure data is shared in a safe and lawful way.
Nottingham Domestic Homicide Review Assurance, Learning …
Milton Keynes — recommendation 2
Methods should be found to publicise ways in which people using illegal drugs can approach agencies about domestic abuse without fear of disclosures about illegal drugs being reported. This may involve local voluntary/ third sector groups.
Milton Keynes Community Safety Partnership | …
Manchester — recommendation 10.2.14
That Central Manchester Clinical Commissioning Group provides MSAB with written guidance on how to access GP records in DHRs where the patient’s permission has not been obtained.
Central Manchester Clinical Commissioning Group
Cwm Taf — recommendation Recommendation No 6
The Department of Health and UK Council of Caldicott Guardians issue guidance on the disclosure of health information in a Domestic Homicide Review, clarifying the criteria and principles on what information is relevant and what is not.
Department of Health | UK Council …
Department of Health and …
Stoke-on-Trent — recommendation National policy 1
The issue of accessing personal data held by general practitioners in the context of DHRs and reliance on consent rather than the legal obligation to be involved and contribute to the review and the substantial public interest to prevent domestic homicide.
Government
UK Government
Sheffield — recommendation 2
The GP Practice to change its policy on redacting third part information from DART referrals in line with National IG good practice Guidelines.
GP practices
Wiltshire — recommendation 8.4.3 iii)
Liaise with primary care services to review the process for sharing information at the point of referral to ensure that: Key information is highlighted and unnecessary information is not provided (as this may breach the patient’s confidentiality and may make significant information harder to identify)
Avon and Wiltshire Mental Health Partnership …
Avon and Wiltshire NHS …
Somerset — recommendation 3
The outgoing provider should provide the incoming provider with client case files as soon as practicable and no less than 3 weeks prior to transfer date, enabling the outgoing provider to organise consent forms from clients and organise files ready for transfer. This will be subject to obtaining client consent.
Bournemouth Churches Housing Association | Knightstone …
North Yorkshire — recommendation 7
The Community Safety Partnership should review its Information Sharing Protocol for information exchange between professionals who are working in the field of domestic abuse and other areas of safeguarding. The revised ISP to be clear on the need for balance between confidentiality and protecting vulnerable people from significant harm and …
North Yorkshire Community Safety Partnership
Nottingham — recommendation d.
Agencies should also ensure that they have appropriate information sharing policies in place that make reference to third party information.
DSVA Strategy Group | National Probation …
National Probation Service
Ealing — recommendation 7.7.2(b)
gain early consent to share information with other agencies in response to identified concerns.
West London NHS Trust | Ealing …
West London NHS Trust
Leicester — recommendation MP1_R3
At the point of registration with a GP; patients to be asked for consent to allow relevant and proportionate information about them to be shared and received with other services to reduce the risk of harm and safeguard themselves or others
Medical Practice 1
Peel Medical Practice
Fenland — recommendation 8
CGL Cambridgeshire will upskill staff to ensure they are aware of how consensual information sharing can support a service user throughout their treatment journey. Staff will feel confident in explaining and exploring consent with service users, particularly in relation to a change in their risk or circumstances.
Change Grow Live (CGL) Cambridgeshire
ISC reports(6)
Statement regarding GCHQ's alleged access to the US PRISM programme
Statement or press release
Jul 2013
Access to communications data by the intelligence and security Agencies
Examination of the intelligence agencies' access to communications data and the draft Communications Data Bill.
Special Report
Feb 2013
Privacy and Security: a modern and transparent legal framework
Inquiry into the intelligence agencies' intrusive capabilities and the legal framework governing privacy and surveillance.
Special Report
Mar 2015
Report on the draft Investigatory Powers Bill
Scrutiny of the draft Investigatory Powers Bill from the perspective of the intelligence agencies' powers and oversight.
Special Report
Feb 2016
International Partnerships
Inquiry into the UK intelligence community's international intelligence sharing partnerships and the safeguards governing them.
Special Report
Dec 2023
China
Inquiry into the security threat posed by China across government, industry, academia and critical sectors, and the intelligence response.
Special Report
Jul 2023
IPCO reports(8)
IPCO Annual Report 2017
The Investigatory Powers Commissioner’s annual report provides an overview on the use of investigatory powers by public authorities and our activities during our first year of operation, 2017.
Annual Report
2017
IPCO Annual Report 2018
The Investigatory Powers Commissioner’s annual report provides an overview on the use of investigatory powers by public authorities and our activities in 2018.
Annual Report
2018
Annual Report 2019
The Investigatory Powers Commissioner’s annual report provides an overview on the use of covert investigatory powers by public authorities, our activities and those of the Office for Communications Data Authorisations in 2019.
Annual Report
2019
Annual Report 2020
The Investigatory Powers Commissioner’s annual report provides an overview on the use of covert investigatory powers by public authorities.
Annual Report
2020
Annual Report 2021
The Investigatory Powers Commissioner’s annual report provides an overview on the use of covert investigatory powers by public authorities.
Annual Report
2021
Annual Report 2022
The Investigatory Powers Commissioner’s annual report provides an overview on the use of covert investigatory powers by public authorities.
Annual Report
2022
Annual Report 2023
The UK intelligence community reported 222 errors in 2023, as restated in the 2024 annual report.
Annual Report
2023
Annual Report 2024
The UK intelligence community reported 333 errors, up from 222 in 2023 (MI5 203, SIS 14, GCHQ 116). No errors met the statutory definition of a serious error causing significant prejudice or harm. Law enforcement surveillance, property interference and CHIS …
Annual Report
2024