Transgender victims of the Gender Identity Clinic data breach could be eligible for £30,000 in compensation
Charing Cross Gender Identity Clinic in South Hampstead, London. (Google Maps)
A year after almost 2,000 people had their personal data leaked in a data breach at London’s Charing Cross Gender Identity Clinic, a law firm says each victim could be eligible for £30,000 in compensation.
The breach happened on 6 September 2019, and saw two email chains sent to “cc” instead of “bcc”, revealing the names and email addresses of around 900 people in each instance.
Some of these individuals also had their highly sensitive medical and personal information shared with everyone in the chain, in a serious breach of patient confidentiality.
Your Lawyers, a consumer action law firm that is representing multiple claimants in the case against Charing Cross Gender Identity Clinic (GIC), one of seven GICs in England that provide healthcare for trans and non-binary people, said that each victim could be eligible for £30,000 in compensation.
Aman Johal, lawyer and director of Your Lawyers, said: “The Charing Cross Gender Identity Clinic severely breached patient trust through an inexcusable and completely preventable error. The sharing of sensitive and highly personal data could have an extremely negative impact on vulnerable people.”
Johal said that “lessons should already have been learned” from previous similar incidents, like the 2015 data breach at LGBT+ sexual health clinic 56 Dean Street, which saw almost 800 patients using HIV services at the clinic have their personal details inadvertently revealed.
The Dean Street leak saw the clinic fined £180,000 by the Information Commissioner’s Office, with a number of claimants represented by Your Lawyers receiving compensation.
“Why organisations still rely on archaic methods of mass communication, when there is plenty of readily available software to use instead that will avoid a data leak, is absurd; especially given the additional clarity and focus that the GDPR has placed on data protection and information privacy since 2018,” Johal added.
“One year on, we continue to fight for justice for those affected. People deserve better when the consequences of a leak can be so damaging, and they are rightfully entitled to seek the compensation that they deserve.”
The firm estimates that compensation awards could range from £15,000 up to £30,000 in the most severe cases, where individuals experienced a significant psychiatric injury.
