Royal Cornwall Hospitals Trust admits FOI-related personal data breach

The Royal Cornwall Hospitals Trust (RCHT) has apologised after an independent investigation confirmed a major personal data breach that exposed sensitive medical data, including sickness and absence records, relating to 7,715 staff and 288 non-trust workers.

The incident occurred when an Excel spreadsheet published in response to a Freedom of Information Act 2000 (FOIA) request in February 2023 inadvertently included hidden sickness data. The file remained accessible online until November 2025. Although patient care, financial information, and contact details were unaffected, the disclosure caused considerable distress and anxiety among current and former staff at hospitals in Truro, Penzance, and Hayle.

The investigation revealed significant lapses in data handling, verification, sign-off, and publication, including failing to convert responses to PDFs as required. RCHT noted that the unauthorised disclosure of special category data breached the UK General Data Protection Regulation (GDPR) and the Data Protection Act 2018 (DPA18), and could result in substantial administrative costs and legal liabilities.

Acting Chief Nursing Officer Bernie George confirmed that the Information Commissioner's Office (ICO) closed its investigation after the trust implemented initial recommendations. RCHT has enacted an action plan to strengthen information governance and digital literacy, though non-executive director Adam Broome noted that wider staff training originally scheduled for completion in November is delayed due to workforce absences.

Training Announcement: Freevacy offers a range of short one-day courses on a range of data-related subjects, including data protection topics such as conducting DPIAs and privacy-by-design, as well as how to use AI tools responsibly, cybersecurity best practices, and information access. The interactive sessions cover basic concepts through to advanced examinations of specific areas. Find out more.