A patient who reported medical sexual misconduct to the General Medical Council (GMC) was sent the intimate personal details of a total stranger who had reported an unrelated offence – an error which she described as “upsetting”.
Diana*, whose story openDemocracy reported in December last year, reported her consultant to the GMC, which regulates doctors in the UK, for sexually assaulting her during a routine examination.
The watchdog’s investigation and report took months to complete as it had to wait for Hampshire police to conduct its own investigation. The police force eventually closed the case with “no further action” citing a lack of evidence, despite having failed to interview witnesses or the suspect, and instead relying on an internal hospital probe.
When Diana eventually received an email from the GMC, she was shocked to find it contained a stranger’s report of alleged domestic and sexual abuse committed by another doctor. The report included the full names of both the alleged victim and perpetrator, as well as the victim’s address and a summary of the alleged offences.
The victim, Diana told openDemocracy, would feel “mortified” to “know I have read all about her sexual and physical assault”.
openDemocracy has reviewed the email thread between Diana and the GMC. The regulator responded with their “deepest apologies” and acknowledged they had “sent the incorrect summary in error”, before requesting Diana delete the report.
Diana was further “shocked”, however, when the summary report of her own complaint included a second data breach. The GMC failed to redact the name of a witness – a nurse present during the procedure – when quoting the police report.
The GMC does not encrypt or password-protect files sent to complainants. Instead, it says it trains staff on protecting complainant data and applies “proportionate safeguards” such as redaction, data minimisation, and secure handling processes. Doing so, it says “ensures information is shared in a way that is secure, accessible, and appropriate to the level of risk”.
Like all public bodies in the UK, the GMC must report any serious breaches to the Information Commissioner’s Office, the independent data protection and information rights regulator. It has made five formal notifications to the office in the last five years.
But in this case, the GMC failed to protect the personal data of a woman alleging domestic and sexual abuse by a medical professional, and the details of a witness who contradicted Diana’s complaint. Victims of rape are legally guaranteed anonymity.
A GMC spokesperson said: “‘We take data protection very seriously and have robust processes in place for reporting and investigating data-related incidents. Any breach of our data protection processes falls below the high standards we strive to achieve when handling personal information.
Sian Norris
“If there is a personal data breach, we implement a rapid incident response to assess whether it meets the threshold for notifying the Information Commissioner's Office, and work in line with UK GDPR requirements. If there is likely to be an ongoing risk of harm to data subjects, we will always make them aware of this.”
No action in 94% of cases
Diana had complained to the GMC after reporting her consultant for sexually assaulting her under a modesty blanket in the run-up to an internal examination.
The GMC opted not to sanction the doctor, who denied all allegations.
In witness statements collected by the hospital, two nurses said they had full view of the entire procedure and did not see the assault take place. But Diana has always maintained that the nurses could not have seen the assault as she was covered by a blanket at the time.
The GMC’s report concluded: “It seems very unlikely that the doctor would have had an opportunity to carry out a sexual assault. That is not to say that it was impossible for a doctor to take such an extreme risk, or that the timing was impossible.”
Questions have been raised about the GMC’s fitness to examine cases of sexual assault. It logged 997 complaints of sexual assault between January 2018 and August 2025; only 53 resulted in suspension or erasure, according to evidence submitted to the Health and Social Care Committee by Labour MP Josh Fenton Glynn in January this year.
“The scale is quite extraordinary,” Fenton-Glynn said, while questioning GMC CEO Charlie Massey. “I do not think that you are sitting in front of this Committee saying that 94% of allegations are unfounded.”
“This is tricky territory, because all sexual misconduct and harassment is unacceptable, but there are varieties,” Massey responded. “The Royal College of Surgeons report talks about moving from clumsy to creepy to criminal. Obviously, the GMC is an organisation that exists to make decisions about taking doctors’ licences away, and there are other players, such as employers, that perhaps operate at the end of that spectrum that is more about clumsy.”
Diana believes the GMC’s report placed too much emphasis on the police’s decision not to interview the suspect, and that it failed to interrogate the nurses’ testimony. The nurses’ witness statements mentioned that Diana did not complain about the consultant’s alleged behaviour at the time. However, delays in reporting are common in cases of sexual assault.
“We know that there are many reasons why survivors may not feel able to disclose sexual assault for a long time, with many living with its impact for years before telling anyone,” said Lisa Durston, from the sexual violence support charity SARSAS. “Shame, stigma and the fear of not being believed (sadly a fear often grounded in reality), or the way that abuse is often normalised by perpetrators and wider society all present massive barriers to telling someone.”
