- Enforcing jurisdiction
- United Kingdom · Geography does not establish applicable law.
- Confirmed applicable legislation
- No confirmed legal basis recorded.
- Privacy topics
Tavistock & Portman NHS Foundation Trust – €91,000 Fine (United Kingdom, 2022)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
The Tavistock & Portman NHS Foundation Trust was fined EUR 91,000 after accidentally sending sensitive patient information to a large group of recipients. This breach occurred due to a failure to protect personal data in email communications. The case highlights the critical need for organizations to implement strong safeguards against data breaches.
What happened
The Tavistock & Portman NHS Foundation Trust sent emails revealing sensitive patient information to multiple recipients.
Who was affected
Patients of the Tavistock & Portman NHS Foundation Trust who were included in the email distribution list.
What the authority found
The Information Commissioner's Office found that the trust did not have adequate measures in place to prevent such data breaches, violating GDPR requirements.
Why this matters
This incident illustrates the importance of robust data protection measures in healthcare settings. Organizations must prioritize the security of sensitive personal information to avoid costly penalties.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Review needed — 10 March 2026.
Processing notes: amount discrepancy.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The UK DPA (ICO) has fined the Tavistock and Portman NHS Foundation Trust EUR 91,000. The Tavistock and Portman NHS Foundation Trust is a mental health specialist trust located in London. In early September 2019, the trust wanted to run a contest asking patients at the adult gender identity clinic to provide artwork to decorate a renovated clinic building. For this, two emails were inadvertently sent with an open distribution list (one to 912 recipients and the second to 869 recipients). It was clear from the content of the email that all recipients were patients of the clinic. The trust immediately recognized the error and unsuccessfully attempted to recall the emails. As part of its investigation, the IOC determined that the trust had no technical or organizational measures in place to prevent or mitigate this highly predictable human error. The ICO rated the harm to affected individuals as high given that information about the affected individuals' relationship with a gender identity clinic is very sensitive personal information. Due to immediate implementation of security measures and extensive cooperation with the ICO, the fine was reduced from EUR 910,000 to EUR 91,00.
Related Enforcement Actions (0)
No other enforcement actions found for Tavistock & Portman NHS Foundation Trust in UK
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
9 June 2022
Authority
Information Commissioner's Office
Fine Amount
€91,000
About this data
Cite as: Cookie Fines. Tavistock & Portman NHS Foundation Trust - United Kingdom (2022). Retrieved from cookiefines.eu
Last updated: