Case Summary and Outcome

The High Court of England and Wales found the General Medical Council’s decision to disclose to a patient an expert report on their treatment by a medical practitioner to be unlawful. Mr. P complained to the General Medical Council that he had been improperly treated by a medical practitioner. The GMC later decided to take no further action on the complaint having taken into account an expert report on the treatment Mr. P received. Subsequently, Mr. P requested that the expert report be released to him. Despite the medical practitioner’s refusal of consent to the expert report being disclosed, the GMC decided to grant Mr. P’s request. The Court judicially reviewed this decision, and found that the GMC had erred in its balancing of the privacy rights of the respective parties. The Court held that the GMC did not attach adequate weight to the fact that the medical practitioner was the focus of the report. Moreover, the Court emphasised that the medical practitioner’s refusal of consent to the disclosure gave rise to a rebuttable presumption against disclosure

Facts

In 2013, a patient who had been diagnosed with cancer of the bladder, Mr. P, complained to the General Medical Council (GMC) alleging that he had been dealt with incompetently by Dr. DB. For the purpose of conducting an investigation into Dr DB’s fitness to practice, the GMC obtained an expert report that concluded Dr. DB’s conduct fell below, but not seriously below, the standard expected. The GMC sent a copy of the report to Dr. DB, and informed him that the complaint had been sent to the case examiners. The GMC subsequently wrote letters to Mr. P and Dr. DB to inform them that the examiners concluded the case with “no further action”.  A short summary of the expert’s comments were annexed to these letters, including his statement that Dr. DB’s care was “below but not seriously below” the expected standard.

Mr. P made a request for a copy of the report from the GMC, with the intention of making a claim against Dr. DB in clinical negligence. The GMC treated this as a request under section 7 of the UK Data Protection Act 1998, which gave data subjects the right to access their personal data. The GMC objected to disclosure under section 35B(2) of the Medical Act 1983, which empowers the GMC to publish or disclose information relating to a practitioner’s fitness to practise where they considered it to be in the public interest to do so.

Dr. DB refused to consent to disclosure of the report on the basis that the report constituted the “personal data” of Dr. DB alone, and that the request for disclosure was with a view to further litigation.

The GMC Information Access Officer was requested to carry out a balance of interests test so as to determine whether the report should be released to Mr. P. The Information Access Officer concluded that it was appropriate to disclose the report to Mr. P in its entirety, concluding that the report should be regarded as Mr. P’s personal data (save for the section concerning Dr. DB’s CV) for the purposes of the Data Protection Act. The Information Access Officer also concluded that following a balance of interests it would be fair and lawful to disclose the report to Mr. P. He further justified the disclosure by emphasizing the GMC’s legitimate interest in transparency, and the need to provide Mr. P with the document that led to the GMC closing the case at an early stage.  The Information Access Officer also stated that it could not be doubted that the information was being sought to further a potential claim in clinical negligence against Dr. DB.

In November 2015, Dr. DB filed a claim for judicial review of the GMC’s decision to disclose before the High Court of England and Wales. In his witness statement, Dr. DB expressed his concern that Mr. P might publish the report to the world at large, including online, causing damage to his professional reputation and mental health.

Decision Overview

The judgment of the High Court of England and Wales (Court) was delivered by Mr. Justice Soole. In its judgment, the Court recognised that a data subject is given the right of access to his personal data under section 7(1) of the Data Protection Act. However, in circumstances where granting access would necessarily disclose information that identifies another individual, the Court noted that section 7(4) of the Data Protection Act only obliges disclosure where (a) the other individual has consented to the disclosure of the information to the person making the request, or (b) it is reasonable in all the circumstances to comply with the request without the consent of the other individual. Section 7(6) of the Data Protection Act then identifies four non-exhaustive factors that need to be considered when deciding whether it is reasonable to comply with the request. The factors that need to be weighed in the balance are (i) any duty of confidentiality owed to the other individual, (ii) any steps taken by the data controller with a view to seeking the consent of the other individual, (iii) whether the other individual is capable of giving consent, and (iv) any express refusal of consent by the other individual.

The Court found that the GMC had erred in performing the balancing exercise required under section 7(4) of the Data Protection Act.

First, the Court noted that when the other individual expressly refuses to give consent, the data controller should have started with a rebuttable presumption against disclosure.

Second, the Court found that the GMC did not give adequate weight to Dr. DB’s status as a data subject or his right to privacy over information in the report. The Court accepted that the report contained the (sensitive) personal data of Mr. P, but the real focus was on Dr. DB and his professional competence. The Court also found that Dr. DB had a reasonable expectation that, if a request was made by Mr. P, “the GMC would carry out a lawful balancing exercise which would include the fact that the Report contained inextricably mixed private information. That reasonable expectation was fortified by the fact of the GMC’s practice in disclosing only a summary to the complainant in such circumstances.” [para. 71]

Thirdly, it was held that the GMC did not pay enough attention to the express refusal of consent by Dr. DB. Instead, the GMC “treated the absence of consent as simply the background trigger for the need to carry out a balancing exercise and gave no specific weight to the explicit refusal of consent.” [para. 76] The Court noted that under section 7(6) of the Data Protection Act the express refusal of consent was a specific factor to be taken into account.

Fourthly, the GMC failed to take adequate notice of the fact that the request was made with the intention to use the report in litigation. The Court noted that “[t]he significance of this factor was two-fold. First, the information was not being sought for the purpose contemplated by the [EU Data Protection] Directive, namely to protect [Mr.] P’s privacy by ensuring the accuracy of the personal data. Secondly, in obtaining the document by this means [Dr.] DB would be deprived of the protection provided [by civil procedure rules limiting the use outside of proceedings of documents disclosed during litigation].” The Court noted that disclosure through civil procedure rules would have been a less restrictive interference with Dr. DB’s privacy right, while offering an appropriate means for Mr. P to obtain access to the report for litigation.

In totality, the Court held that the GMC’s decision to grant the access request was erroneous and unlawful. The Court noted that the factors relied on by the GMC were not sufficient to counter-weigh the balance in order to allow the granting of access. For instance, the Court found that the GMC’s reliance on the need for transparency in its decision-making processes was undermined by its own policy of only providing summaries of expert reports when notifying complainants that no further action would be taken on their cases.