Pharmacist caught spying on friends' med records fined £1,000

Sussex magistrates issue stiff wrist-slapping


A pharmacist who unlawfully spied on family and friends’ medical records has received a modest fine after he was convicted of data protection offences.

Harkanwarjit Dhanju, 50, was convicted of unlawfully accessing the medical records of family members, work colleagues and local health professionals while working as a "sessional pharmacist" for West Sussex Primary Care Trust.

Dhanju was prosecuted under section 55 of the Data Protection Act, found guilty and fined £1,000. He was also ordered to pay a £100 victim surcharge and £608.30 prosecution costs at Barkingside Magistrates' Court on Thursday.

At the time of his offences, Dhanju had responsibility for handling medication reviews for patients in local residential care homes with dementia and other mental health issues. A surgery manager at Tile House Surgery discovered that Dhanju was using his security pass to access unrelated medical records during a routine audit back in February. Tile House Surgery was one of three surgeries within West Sussex Primary Care Trust that Dhanju was working at during the relevant period.

The infraction was reported to data privacy watchdogs at the Information Commissioner’s Office who decided to bring a criminal prosecution against Dhanju.

In a statement, ICO Head of Enforcement, Stephen Eckersley, said: "There is no justifiable reason why Dhanju needed to spy on the medical treatment of all of these people… he knew he was committing a criminal offence but he decided to carry on regardless."

“The public will be rightly concerned that a medical professional in a position of trust decided to act in this way. We hope today’s prosecution sends a clear message to anyone who may be tempted to do likewise, that unlawfully accessing people’s medical records is a criminal offence and will result with you being rewarded with a day in court,” he added.

Unlawfully obtaining or accessing personal data is a criminal offence under section 55 of the Data Protection Act 1998. The offence is punishable by way of “fine only” - up to £5,000 in a magistrates' court or an unlimited fine in Crown court. The ICO continues to call for more effective deterrent sentences, including the threat of prison in the most serious cases, to deter the unlawful use of personal information. ®


Biting the hand that feeds IT © 1998–2020