F was very upset when he found that his Social Worker, implied by his signature block in an email to a contractor, that F was either HIV+ or ‘physically disabled’, or both.
When F complained, the text was changed. However, that was far too late. Someone, somewhere became aware of F’s HIV+ status, when this was NONE of his business, and also NOTHING to do with RBKC, as confirmed much later by the Department of Health, that ‘local authorities are NOT entitled to ask for, or be provided with confidential medical information, including HIV status.
The reason is that local authorities DO NOT provide services, where it is IMPERATIVE for individuals’ HIV status to be know. All the services are NON-HIV specific. It can be assumed that majority of service users are unaware of their HIV status.
THE ONLY places where it is IMPERATIVE for this information, and much more besides, to be known, are the specialist HIV Clinics, which are the ONLY places, which examine and prescribe retroviral medication, which controls the progress of the condition. This medication is NOT available from GPs and High Street Chemists.
To ensure that more care is taken in the future in handling of his personal information, in May 2010, F issued an amendment to his ‘Information Sharing Agreement.’
In this amendment he instructed RBKC that his explicit written consent must be sought, when a disclosure of his personal information was contemplated. He also instructed that his HIV related information should be deleted from his files.
This may have appeared as an over reaction, but it was confirmed by the Department of Health that RBKC should NOT even be in possession of this information.
Although F asked for a confirmation of his instructions, NONE CAME. He assumed that RBKC had acted on his amendments, as they had ample time to reply. However, his Confidentiality Table was amended to reflect the need for consent.
It came to light much later, that F’s amendment was in fact a NOTICE, in compliance with paragraph 10 of the Data Protection Act. Details of handling of this explained in ICO own guidelines, which assumedly would also apply to any other data controller, RBKC in this case.
The NOTICE required RBKC to reply within 20 days, telling F whether they agreed wit his instructions or not. If RBKC disagreed, they were obliged to tell F the reason for their full or partial refusal to comply, NONE CAME.