It is in the news that a doctor inappropriately accessed and distributed a patients medical records. They did this through their employer, Cambridge University Hospitals (CUH) at Addenbrookes. The data was accessed via two IT systems, "Epic", Addenbrooke’s own hospital medical records system and "GP Connect" where the sensitive data was stored. The highly sensitive data concerning family medical issues was distributed to acquaintances of the patient.
The information commissioner, who I would take to be in charge of the Information Commissioner's Office (ICO), said:
The information commissioner said it had no power to help the woman and that it was CUH, and not her, that the data breach had affected.
From the ICO website About the ICO/What we do/How we handle concerns:
Part of our role is to improve the information rights practices of organisations by gathering and dealing with concerns raised by members of the public.
In cases where a clear and serious breach of the legislation has taken place, we will take direct action on the specific concern raised. If we decide that there has been a serious failure to comply with the law, we will provide advice and instruction to help ensure the organisation gets it right in future. If an organisation isn’t taking its responsibilities seriously, we may also take enforcement action. In the most serious cases, we can serve a monetary penalty of up to £17.5 million, or 4% of your total worldwide annual turnover, whichever is higher.
It seems to me that this doctor processed and distributed the victims data without a legitimate purpose, and therefore this is a clear and intentional breach of the GDPR. Therefore I would have thought the ICO would have an explicit role in dealing with this matter. What exactly is the ICO's role in GDPR enforcement, and if they have no power to deal with this what would be the appropriate entity for an individual whose data was processed in this way to report such unauthorised data processing to? It should be noted that the source of the data was only identified after significant investigation.
