Peter A Clarke

The UK Information Commissioner’s office has prosecuted a pharmacist who worked for the South West Essex Primary Care Trust for accessing data, in the form of medical records, of family members, work colleagues and other health professionals.  In certain industries unauthorised access can be a chronic problem, such as bank employees viewing records of family, friends and enemies (see Jones v Tsige in Canada) and the continuous problem with police forces preventing their members from looking up records, warrants and other law enforcement data relating to friends, family, baby sitters, neighbours and whoever takes their fancy, the number one example of this is the Victorian Police’s difficulties in keeping police officers from misusing the LEAP database.

In the UK there are, appropriately, significant enforcement powers for unlawful access.  Which is what happened to the hapless Harkanwarjit Dhanju.  The media release, Pharmacist who unlawfully spied on family and friends’ medical records prosecuted is found here and provides:

A pharmacist who worked for South West Essex Primary Care Trust has been prosecuted by the Information Commissioner’s Office (ICO) after unlawfully accessing the medical records of family members, work colleagues and local health professionals. 

Appearing at Barkingside Magistrates Court today, Harkanwarjit Dhanju, 50, was prosecuted under section 55 of the Data Protection Act and fined £1000, ordered to pay a £100 victim surcharge and £608.30 prosecution costs.

Dhanju unlawfully accessed the patients’ records while working as a sessional pharmacist at Tile House Surgery, Mount Avenue Surgery and Rockleigh Court Surgery. At the time, Dhanju had responsibility for handling medication reviews for patients in local residential care homes with dementia and other mental health issues. However, during a routine audit, the surgery manager at Tile House Surgery uncovered that Dhanju was using his security pass to access unrelated medical records. The matter was reported to the ICO on 22 February 2013.

ICO Head of Enforcement, Stephen Eckersley, said:

“There is no justifiable reason why Dhanju needed to spy on the medical treatment of all of these people. However, he knew he was committing a criminal offence but he decided to carry on regardless.

“The public will be rightly concerned that a medical professional in a position of trust decided to act in this way. We hope today’s prosecution sends a clear message to anyone who may be tempted to do likewise, that unlawfully accessing people’s medical records is a criminal offence and will result with you being rewarded with a day in court.” 

Unlawfully obtaining or accessing personal data is a criminal offence under section 55 of the Data Protection Act 1998. The offence is punishable by way of ‘fine only’ – up to £5,000 in a Magistrates Court or an unlimited fine in a Crown Court. The ICO continues to call for more effective deterrent sentences, including the threat of prison in the most serious cases, to be available to the courts to stop the unlawful use of personal information.