Former MSG partner and PA cleared of data law breaches

Consultant Ali Shokouh-Amiri, 52, of 77, Elizabeth Gardens, Rochford, Essex, denied three offences of knowingly or recklessly breaking the laws.

One charge was that he held the medical records of 272 Guernsey patients on his mobile phone without the consent of the MSG’s data controller.

The other charges related to two women whose photographic images he obtained and retained without this consent.

Danielle Thomas, 28, of Flat 9, Maison de Jersey, Mon Plaisir, St Peter Port, pleaded not guilty to five charges.

It was alleged that on two occasions she disclosed patient medical records by sending them to her personal address without the consent of the MSG’s data controller.

She was also accused of obtaining and retaining 74 photographic images containing personal data on her mobile phone, and disclosing personal data of one woman to Mr Shokouh-Amiri and, subject of a further charge, his wife, via WhatsApp.

The prosecution case called no witnesses and relied on admissions made. It was not disputed that the data was on the phones and messages and emails had been sent.

The defence case was that Mr Shokouh-Amiri was the data controller in this instance and so had permission to hold these records as well as deal with the photos, while Miss Thomas was his personal assistant and acting on his instructions.

But prosecuting advocate Marc Davies said that being the data controller did not give the right to do what one liked with someone’s private data.

The photos in the charges were intimate photos of patients taken by Mr Shokouh-Amiri in the course of his work. One of these was sent to a doctor at Southampton General Hospital.

While the women could not be identified from the photos, Advocate Davies argued that the context in which the pictures were kept or sent allowed for the patients to be identified.

Both Advocate Sarah Brehaut, for Mr Shokouh-Amiri, and Advocate Claire Tee, for Miss Thomas, said that all partners of the MSG were data controllers and so he was able to give himself permission to store the information and Miss Thomas was acting upon his instructions.

At the time of the alleged offences Mr Shokouh-Amiri was carrying out his job as an obstetrician and gynaecologist and so it made sense for him to have hundreds of his patients’ medical records that were easily accessible to him and him alone on his phone.

The defence advocates initially asked Judge Gary Perry to rule that there was no case to answer. After deliberation, the judge said he could only do this in relation to the first charge against the consultant, concerning the 272 patient records.

Two further charges were dropped after Advocate Brehaut said that the dates were before the current data protection law had come into effect. Judge Perry refused leave to amend the dates.

As a result, a charge against Miss Thomas relating to knowingly or recklessly obtaining and retaining 74 images of medical records was dismissed, as was a charge concerning obtaining and retaining the photo of a patient against Mr Shokouh-Amiri.

Judge Perry went on to find both defendants not guilty of all remaining charges.

‘Both defendants’ attitude to data protection was, at best, cavalier,’ he said, but reprehensible conduct was not necessarily criminal conduct. The least patients could expect at a difficult time in their lives was that their personal information would be treated with the respect it deserved.

Reaction to decision

A SPOKESWOMAN for the MSG said that Mr Shokouh-Amiri ceased his role as consultant obstetrician and gynaecologist on 31 August 2019, when he also left the partnership. He had not seen any patients locally since January 2019.

‘We are considering the ramifications of the judgement,’ she added.

Guernsey data protection commissioner Emma Martins said the Office of the Data Protection Authority would be seeking a copy of the judgment. ‘We want to make sure that we have sight of the judgment and its reasoning before making any comment.’