RCGP admits data leak

By Ellie Philpotts

The Royal College of General Practitioners has admitted to sharing contact details of its conference speakers to external organisations, without their permission.

Doctors.net.uk understands at least seven doctors' email addresses were passed to international companies and exhibitors from a recent event.

They have shared their frustrations after receiving multiple emails from the organisations, with one GP fielding more than ten.

The GPs were booked to speak at the RCGP’s annual conference in Glasgow on 19 and 20 October. However, at least one speaker did not even attend in person.

A former RCGP Wales chair is among those affected by the leak.

GP Dr Rebecca Payne told Doctors.net.uk: “I’ve started to lose count of how many emails I’ve had from the event exhibitors, many of whom say thanks for talking to them, when I didn’t even make it to the conference as I had Covid! I can only assume I’d accidentally ticked a box when signing up for the conference that allowed them to contact me.

“Still can’t believe the RCGP is passing my details to other countries!”

One of the emails Dr Payne received came from Canada. It said: “Your information has been shared with me as a result of your attendance to the RCGP conference held in Glasgow.

“If you are looking for opportunities to practice in Canada I would love to connect and gather more information from you on what you’re looking for to see if we can find something that fits your needs within our group of clinics.”

Another GP, who wished to remain anonymous, told Doctors.net.uk: “I've just had some random emails from various companies saying that it was good to talk at the conference. I was there as a speaker but got emails from companies I hadn't talked to. But I don't remember ticking/not ticking the box about marketing.”

Data breaches ‘taken extremely seriously’

In response, Dr Margaret Ikpoh, who leads the RCGP’s conference management group, told Doctors.net.uk: “The College takes the security and safeguarding of our members’ data very seriously and without delay completed a full risk assessment with our external conference partner who manages the conference data on our behalf.

“Sharing basic contact details with exhibitors and sponsors is standard practice at the RCGP Annual Conference and Exhibition, with attendees given the option to control whether their data is shared.

“Unfortunately, in this instance, we identified that limited contact details pertaining to a very small number of registrants of the 2023 conference were shared with exhibitors and sponsors without the requisite permissions in place. This error has now been rectified.

“We would like to apologise to those individuals affected and for any subsequent emails they may have received.”

Dr Ikpoh later added: “We take any breaches of data extremely seriously. Following our risk assessment which included consideration of the impact on individuals involved, we do not believe it is necessary to notify the Information Commissioner’s Office.’

Investigation underway

Dr Payne, also a National Institute for Health and Care Research in-practice fellow at the University of Oxford, raised her concern formally with the RCGP’s external events team, who assured her that they have launched an investigation alongside the RCGP.

In a response, seen by Doctors.net.uk, the team told her: “We can confirm that the contact details you provided us when registering to attend the RCGP Annual Conference and Exhibition 2023 as a speaker, were mistakenly shared with the list of exhibitors without the request permission in place.

“Please be aware that this mistake was not widespread. We will be conducting a full review of our processes to ensure something like this doesn’t happen again.

"We are very sorry about this and thank you again for bringing it to our attention.”

The events team also told her the error in its speaker data collection has been corrected, and all exhibitors have been told to destroy the original data they were given.

Last week, the RCGP had another unwelcome IT incident, when GP trainees nationwide were unable to complete their SCA exam due to an IT outage.

It prompted 1,800 people to sign a petition calling for refunds or earlier resists to be offered to those affected.

‌
‌
‌
‌
‌
‌