- Enforcing jurisdiction
- United Kingdom · Geography does not establish applicable law.
- Confirmed applicable legislation
- No confirmed legal basis recorded.
- Privacy topics
NHS Highland – Reprimand (United Kingdom, 2023)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
NHS Highland received a reprimand for mistakenly sending an email to 37 people using CC instead of BCC, exposing their email addresses to each other. This breach of privacy could lead to unwanted contact among recipients. It serves as a reminder for organizations to use proper email practices to protect personal information.
What happened
NHS Highland accidentally used CC instead of BCC when emailing 37 individuals likely accessing HIV services.
Who was affected
The 37 individuals who received the email and had their personal email addresses exposed.
What the authority found
The Information Commissioner's Office reprimanded NHS Highland for failing to protect personal information in the email.
Why this matters
This incident highlights the need for careful handling of personal data in communications, especially in sensitive contexts like healthcare.
Source checks
Linked-source text retrieved.
Automated check recorded — 16 October 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A formal reprimand has been issued to NHS Highland, which emailed 37 people likely to be accessing HIV services, inadvertently using CC (carbon copy) instead of BCC (blind carbon copy). The error meant recipients of the email could see the personal email addresses of other people receiving the email, with one person confirming they recognised four other individuals, one of whom was a previous sexual partner.
Outcome
Reprimand
A formal reprimand: the DPA found a violation and issued a formal censure.
Related Enforcement Actions (0)
No other enforcement actions found for NHS Highland in UK
This is the only recorded action for this entity in this jurisdiction.
Details
Decision Date
9 March 2023
Authority
Information Commissioner's Office
About this data
Cite as: Cookie Fines. NHS Highland - United Kingdom (2023). Retrieved from cookiefines.eu
Last updated: