By John Mack Freeman
The National Health Service in Greater Glasgow and Clyde (Scotland) mistakenly released the names of 86 trans patients earlier this week. After an internal investigation, the release was attributed to human error. The error occurred when individuals receiving gender treatment received a mass e-mail in which none of the other e-mails had been obscured in a BCC. James Morton of Scottish Transgender Alliance spoke out in a statement:
The sharing of sensitive personal information without consent is unlawful whether or not it was accidental. The Data Protection Act 1998 and Human Rights Act 1998 together create strict obligations of confidentiality.
The fact that the data potentially identifies the gender reassignment history of individuals in possession of gender recognition certificates further increases the seriousness of the breach since violating the privacy protections of the Gender Recognition Act 2004 can result in criminal charges against individuals.
We believe this breach most likely occurred because NHS Gender Identity Clinics [GICs] are so under-resourced. Chronic under-staffing means that the GICs have long been struggling not just with treatment delivery but also with basic administration.
