Likewise, have a look at how the PHSO operates.
In this respect, see the post dated 3rd December 2018, dealing with the occasions when the PHSO ‘ gets it wrong’.
In the post, we re told that we may challenge PHSO’S ‘DRAFT’ decision in the matter. However, we recall that F was NOT given this opportunity. Ms Bowes skilfully bypassed this stage.
When the ICO produced his Review, he suggested to F that should he be unhappy with the outcome, he may complain to the Parliamentary & Health Service Ombudsman, (PHSO).
He was not at all obliged to do so. He thought of asking his MP, SIr Malcolm Rifkind, QC to intercede on his behalf with RBKC. Is it not our MP’s job to assist in resolution of problems with local authorities. F hoped, rather foolishly, that Sir Malcolm would assist and resolve the matter at a local level, to avoid any possible embarrassment to RBKC. MPs, particularly those of the same political hue as the authority, do not interfere in local matters matters, which may create an embarrassing situation.
F was given to understand that complaint to the PHSO can only be made through his MP, Sir Malcolm Rifkind.
On 19th October 2012, F submitted his complaint to Sir Malcolm.. It would be naive to think that he, a well known QC, was not aware of the basic principles of CONFIDENTIALITY. a term everyone was at great pains to avoid, for fear of opening a new can of worms, which might lead the matter in an unpredictable direction. He preferred to just countersign F’s complaint and pass it to the PHSO. Job done, any embarrassing questions avoided.
On 31st October 2012 he received PHSO’s acknowledgement of his complaint. F provided additional information and documents to support his complaint.
On 22nd February 2013 F received PHSO’s decision. Ms Bowes merely reiterated the ICO’s assessment.
It is evident from F’s complaint and subsequent correspondence with the PHSO, that he was unaware at that time of the NHS Statutory Restrictions on data handling, ICO’s “Data Sharing Code of Practice”, Department of Health “Confidentiality – NHS Code of Practice”, DPA’s paragraph 10 and HRA’s article 8. However, the PHSO, being the Health Service Ombudsman, should have been well aware of these important Codes.
It can be alleged that the PHSO chose NOT to introduce these into the equation, as they were not obliged to do, to avert any possible return to the ICO’s assessment.
Ms Bowes states in her ‘decisions;, at ‘Our role’ that ‘we could only take further action if there was an indication of administrative fault by ICO which affected you and had not been put right by ICO.’
It is clear that Ms Bowes chose to ignore the fact that F’s information was not only of ‘Medical Confidential‘ nature, but also about his HIV+ status, which must be handled in accordance with existing legislation, codes and guidelines.
ICO’s administrative fault was that he chose to ignore RBKC’s willful and wanton disregard of F’s right to CONFIDENTIALITY. Moreover, the role played by the Statutory Restrictions on data handling, applicable to HIV relevant information and Article 8 of the Human Right Act. The ICO issued his assessment, without knowing the nature of the disclosed information.
Furthermore, RBKC chose to ignore all of the 7 Caldicott Principles, governing handling of F’s medical information.
In respect of HIV relevant information, the ICO should have advised F that any concerns about its disclosure in breach of the NHS Statutory Restrictions on data handling, should be addressed to the NHS, as the legislation is outside of ICO’s remit. This was confirmed to F by the ICO on 6th January 2016 in his response RCC0453466. That should have been the extent of ICO’s response.
On 24th August 2011, the LGO asked RBKC, ‘I would be grateful if you could provide me with copies of all the assessment documents for this matter so that I may consider the complaint, along with any comments the Council wishes to made.’
In her ‘decision’ Ms Bowes stated that ‘ICO told us that the information the Council had provided to the LGO was not obviously irrelevant to LGO’s request for information.. They did not think it was likely the Council beached the Act. We do not think ICO’s approach was unreasonable and it did not therefore amount to an administrative fault.’
This is utter nonsense. This statement is so absurd, to be outside the Realm of sanity. How could ICO make such a statement, without knowing the exact nature of the information disclosed to the LGO.
The ICO’s statement and the fact that PHSO echoed it, endorses both organisations the poor understanding of the matter and the relevant legislation.
It must be remembered that a single mention of the acronym HIV, or inference to it, in a wrong context, is a breach of the NHS Statutory Restrictions on data handling.
However, of interest is the ICO handling of the ‘accidental’ disclosure of email addresses of subscribers to Soho HIV Clinic’s Newsletter on 1st September 2015.
The ICO imposed a hefty penalty on the Trust, for merely implying that those subscribing to the Newsletter, may be HIV+.
Anyway, any disclosure of information must be compliant with the ICO’s Data Sharing Code of Practice, where section 4 – Data Sharing and the Law is very clear what process must be followed.
At least six documents sent to the LGO contain information relating to F’s HIV+ status. The progress of the condition, the medication he must take to stay alive and the inevitable side effects he suffers as a consequence.
It must also be remembered that had the LGO asked for F’s HIV related information, RBKC was not compelled to provide it, as it should have availed itself of paragraph 29-(7) of the Local Government Act 1974, which provides an exemption.
On 17th May 2013, F sent additional information to the PHSO, so that his complaint could be reviewed.
On 8th June 2017 we contacted the GMC about the NHS Statutory Restrictions, who referred us to the NHS. As the GMC are the Regulators of the medical professions, we hoped they may give us some assistance.
On 22nd June 2017 NHS England was contacted. They told us to contact the PHSO.
On 26th June 2017, the PHSO was contacted and their reply dated 21st September 2017 is clear.