Adoption data breach compensation claims

A data breach happens when unauthorised people access private information or it is released in to an uncontrolled environment.

Data protection breach examples include:

• Your name and/or address or other personal details being disclosed to the birth parents
• Your medical records being sent to the wrong postal or email address
• Your personal details being included in a group email

A document not being properly redacted or anonymised before being disclosed to a third party.

There are many ways in which a data breach can occur during adoption.  For example:

• Inadequate redaction of documents that are properly disclosed to the birth family (e.g. Annexe A, Looked After Child reviews)
• The birth family being sent documents to the birth family that they are not entitled to (e.g. a Viability assessment)
• Inadvertent disclosure of information – for example, location of contact arrangements, failing to blind copy parties to group emails

Even though it may be another party who causes the data breach there are a number of things which you can do to reduce the risk of a data breach taking place.  For example:

• Be alert: Report any data security concerns to the adoption agency or Local Authority immediately.
• Check contact methods: Understand and review how contact is managed between all parties.
• Understand foster carer roles: Know how foster carers handle sensitive information.
• Secure post-box use: If applicable, ensure post-box procedures are secure.
• Manage social media: Be cautious with pre- and post-adoption online activity.
• Consider name change security: Understand how name changes are handled.

If a data breach occurs:

Immediately notify relevant parties

• Inform the Local Authority and the adoption agency.
• Depending on the nature of the breach, consider notifying the police, the child’s school, and other directly affected family members.

Maintain open communication

• Keep a clear and consistent dialogue with the Local Authority to understand the situation and the steps being taken.

Identify the scope of the breach

• Determine precisely what private information has been disclosed.

Assess rectification and recovery

• Inquire whether the breach can be fixed and if the disclosed personal information can be securely retrieved. Understand the efforts being made in this regard.

Request a risk assessment

• Ask the Local Authority to conduct a thorough risk assessment, specifically evaluating any potential risks the breach poses to the child and your family from the birth family.

Review social media activity

• Carefully review your own social media presence and, if possible and appropriate, monitor the social media activity of the birth family for any potential repercussions of the breach.

If adoption proceedings are ongoing

• Crucially, ensure the child’s Guardian is immediately informed of the data breach.
• Consider whether you need to attend/have legal representation at any hearing

Implement immediate security measures

• Evaluate if you need to take urgent steps like installing CCTV or a video doorbell.

Explore additional support

• Discuss with the Local Authority if extra security measures should be included in the Adoption Support Plan.

Seek legal counsel

• Obtain legal advice to understand your rights and options.

Stay vigilant

• Remain watchful for any further issues or consequences related to the breach.

By following these steps, you can ensure that the data breach is addressed effectively and that the necessary measures are taken to protect the child and your family.

You have a right to claim damages if you have suffered distress and/or financial losses as a result of a data breach.

Every case is different and whether you are entitled to damages will be dependent on the specific circumstances and will require careful consideration by a specialist lawyer.

You can bring a claim for damages against any organisation who has misused your personal information, negligently disclosed information and/or broken data protection laws.

Examples of those organisations that may hold your information, disclosure of which could cause serious outcomes are:

• Local Authority
• Social Services
• The Courts
• Police
• GP
• Hospital

Yes. There are a number of strict time limits that may apply to a claim for damages for the consequences of a data breach. In some circumstances the time limit could be one year from the date of the breach. Therefore, it is important that you seek legal advice as early as possible to ensure your claim can be brought.

There are different ways of paying your legal fees. The most common arrangement is a “no win, no fee” agreement, also known as conditional fee agreement. Subject to your compliance with the terms of the agreement you will not be asked to pay any money up front or be required to pay any money to our legal fees if your claim is not successful.

Damages will reflect both the financial and non-financial impact that a serious data breach has had on you.   Damages can help towards the costs you need to take, or have already taken, to protect your family.

We have recovered damages to allow clients to relocate, change their name, install security measures and to reflect the impact that the data breach has had on their lives, including loss of earnings.