Mr Matthew McConville, the Head of our specialised Data Breach Department at Irvings Law has successfully represented Mr Faizal Mahmed in his data breach compensation claim against the DWP after they sent his medical assessment report to his old address when he had informed them of his new one.
In July 2019, Mr Mahmed contacted the DWP by telephone for medical examination results following a recent application for benefits that he had made. Mr Mahmed was advised that the said results had been sent to a previous address of his despite him notifying the DWP of his address change upon his new application. The said medical examination results disclosed the following personal and sensitive information relating to Mr Mahmed:-
- His National Insurance Number.
- That he was a serving Police Officer.
- That he had applied for Industrial Injuries Disablement Benefit.
- That he had an industrial accident on 26/10/2013 following which he had an assessment.
- That he was involved in another accident on 04/04/2014 and he attended A&E in respect of this accident to undergo a MRI scan that revealed ligament damage.
- That he had an arthroscopy in September 2014, had an operation in March 2015 in which the said damaged ligaments were repaired.
- That he was discharged from orthopaedics in 2015 but was restricted to desk duties.
- That he was suffering constant pain in his right knee for which he was self-medicating with analgesics.
- The clinical findings from the said assessment.
When Mr Mahmed found out about this, he approached specialist Data Protection Solicitor, Mr McConville and without hesitation no win, no fee terms were offered. Once instructed, Mr McConville lodged a complaint to the DWP whom accepted that a breach had occurred and that training was to be given to their staff to avoid reoccurrence; they also gave £100.00 as a consolatory payment to Mr Mahmed. After this , Mr McConville then lodged a formal Letter of Claim to the DWP and alleged that they had breached / invaded Mr R’s privacy under the Human Rights Act, had breached the Data Protection Act 2018 / the General Data Protection Regulation (GDPR) as well as confidence following their misuse of private information pertaining to Mr Mahmed.
Upon receipt of this, the DWP accepted liability but argued that the breach was so insignificant to Mr Mahmed in terms of information breached and the effect of it. As no offers of settlement were entertained by DWP, Mr McConville advised Mr Mahmed to issue and serve Court proceedings. Finally, after a nearly eighteen months and a lot of legal costs incurred, the DWP changed their stance shortly before any Court Trial and settled Mr Mahmed’s claim for £1,500.00 plus his legal costs.