To ask the Minister of Health (i) whether Health and Social Care Trusts notify a patient when they become aware of a data breach concerning personal information; and (ii) whether his Department holds any monitoring data in relation to this.

Under Data Protection legislation each Health and Social Care organisation is designated an independent ‘data controller’. The Information Commissioner’s guidance, states that they should have policies and procedures in place to manage potential data breaches. These will include consideration of notification of breaches to the Information Commissioner’s Office and to data subjects involved.

The Department does not monitor information in relation to such matters as this is the responsibility of the regulator.