Manx Care has been served an enforcement notice by the Information Commissioner over its failures in the way a data request from a former employee was handled.

The notice requires the healthcare provider to conduct a review of its handling of subject access requests - and could lead to a fine if matters are not improved.

It’s the second such notice issued by the Information Commissioner since 2021.

The former employee had made a request for specific information about their interview and employment that the Commissioner said would reasonably be expected to be located by local, targeted searches.

But Manx Care did not provide the data until four months after the request was made.

More than 4,000 items were returned by the searches, a disproportionately high amount given the specific nature of the request.

Information Commissioner Dr Alexandra Delaney-Bhattacharya said in her ruling: ‘Manx Care will not be able to improve compliance with statutory timeframes until it revises its approach to how searches are conducted. ‘

The individual who made the subject access request provided their full name, home address, personal email address, mobile phone number and payroll reference number.

But Manx Care further requested photographic proof of identity plus proof of address.

The Information Commissioner queried why this was necessary. The healthcare body replied that they did not want to assume that the requestor was the same individual as a former employee with the same name.

‘It is difficult to understand why Manx Care would consider this an assumption rather than a logical conclusion,’ noted the Commissioner.

She noted that the 2021 enforcement notice is still active but processing of subject access requests has not been brought into compliance.

And she warned: ‘If the right of access is not improved following this enforcement notice, the Commissioner will consider regulatory action that may result in a monetary penalty.’