- Enforcing jurisdiction
- United Kingdom · Geography does not establish applicable law.
- Confirmed applicable legislation
- No confirmed legal basis recorded.
- Privacy topics
Staines Health Group – Complaint Upheld (United Kingdom, 2025)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
Staines Health Group, a GP clinic, faced a reprimand from the UK's Information Commissioner's Office after mistakenly sending 23 years of a patient's medical records to their insurer instead of the requested 5 years. This breach of data protection rules emphasizes the need for healthcare providers to handle patient data carefully and accurately.
What happened
The clinic disclosed 23 years of medical records instead of the 5 years requested by a patient.
Who was affected
A patient whose medical records were improperly shared with an insurer.
What the authority found
The ICO found that the clinic violated multiple data protection principles by sharing excessive personal data.
Why this matters
This case serves as a critical reminder for healthcare providers to ensure that they only share necessary information. It highlights the importance of proper data handling practices to protect patient privacy.
Source checks
Linked-source text retrieved.
Automated check recorded — 18 March 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
Staines Health Group (the controller) is a General Practitioner clinic. A patient (the data subject) requested their medical history from the last 5 years to be sent to their insurer by the controller. The controller allegedly disclosed 23 years of the data subject medical records to their insurer. The DPA found that the controller infringed Article 5(1)(c) UK GDPR, Article 5(1)(f) UK GDPR, Article 32 UK GDPR and Article 33 UK GDPR and issued a reprimand. Firstly, the DPA noted that the controller shared personal data that were not adequate, relevant and limited to what was necessary in breach of Article 5(1)(c) UK GDPR. Specifically, the DPA found that the controller transmitted the medical records of the past 23 years to the data subject’s insurer even though the request of the data subject referred only to the medical records of the last 5 years. Moreover, the DPA found that the controller did not ensure the appropriate security of the personal data processing by failing to ensure, among other things, the existence of written guidance for handling insurance requests, thus breaching Article 5(1)(f) UK GDPR and Article 32 UK GDPR. Finally, the controller did not contact the DPA within 72 hours of being aware of a data breach, in violation of Article 33 UK GDPR.
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for Staines Health Group in UK
This is the only recorded action for this entity in this jurisdiction.
Details
Decision Date
16 December 2025
Authority
Information Commissioner's Office
About this data
Cite as: Cookie Fines. Staines Health Group - United Kingdom (2025). Retrieved from cookiefines.eu
Last updated: