DB v General Medical Council

The claimant, Dr B (“C”) was a general medical practitioner. He had a patient (“P”) who was diagnosed with bladder cancer after having suffered difficulties with urinating for a number of years. Following a complaint by P, the General Medical Council (“GMC”) commenced an investigation of C’s fitness to practise. That process included the instruction of an independent expert GP who reviewed the case and produced a report in May 2014 (“the Report”).

The issues in the case arise primarily from the fact that the Report contained “mixed personal data” of two individuals – the personal data of a GP (C) and patient (P) – which required the competing interests of the two to be balanced.

The Report found that the care provided by C to P fell “below” but “not seriously below” the expected standard of care. The GMC sent C a copy of the Report. P was not sent the full report but was informed that no further action was being taken and was provided with a summary of the reasons given for that decision.

P made a subject access request under section 7 of the Data Protection Act 1998, seeking disclosure of the full report prior to bringing a potential claim against C for clinical negligence. C objected to the disclosure, but the GMC considered it “reasonable in all the circumstances” that the report be disclosed.

To restrain disclosure, C brought a Part 8 claim, and an injunction was granted against the GMC. The GMC agreed to suspend the intended disclosure of the Report pending the decision of the High Court.

C’s claim was allowed by Soole J.  The GMC appealed that decision.

The GMC advanced four grounds of appeal:

(a)  That it was an error to proceed on the basis that, in a case of “mixed personal data” there is a rebuttable presumption against disclosure.

(b)  That it was an error to hold that, where the sole or dominant purpose behind a subject access request is to obtain information for the purpose of litigation, that was a weighty factor in favour of refusal.

(c)  That the court’s reasoning was flawed in holding that the GMC (i) gave inadequate consideration to C’s privacy rights, (ii) took inadequate account of C’s express refusal of consent, and (iii) underestimated the incremental impact of the disclosure of the report over and above the summary.

(d)  That the court (i) “effectively substituted” its own assessment of the case for disclosure, rather than review the decision of the data processor, (ii) over-estimated the risk of P publishing the report, and failed to consider that C had preventive legal options open to him to block such abuse, and (iii) gave inadequate consideration to P’s “fundamental rights… to obtain and understand information about him of a highly sensitive nature.”

Allowing the appeal (Irwin LJ dissenting):

1. In a mixed data case, sections 7(4)-(6) of the DPA set out a “balancing regime” and do not impose any presumptive starting point or hurdle which either the requestor or objector has to overcome; the question is whether “it is reasonable in all the circumstances to comply with a [subject access request] without the consent of the other individual” [70].#
2. A presumption in favour of withholding disclosure should only be applied as a ‘tie-breaker assumption’ at the end of the section 7(4)-(6) balancing exercise, in circumstances where a data controller in a mixed data case is left with factors for and against disclosure which are found to be in perfect equilibrium with nothing to choose between them [71].
3. The judge erred in criticising the GMC for a) proceeding without reference to any presumption, and b) for applying a strong, substantive presumption in favour of the objector in his own assessment of how to strike the balance between C and P [74].
4. The interests of the requester, when balanced against the interests of the objector, are not devalued where the motive (or part of the motive) is to seek to obtain information which might assist the requester in litigation against the objector. That is a factor to be weighed in the overall balancing exercise. The judge erred in considering the litigation motive as being a ‘weighty’ factor in favour of refusal. [75]
5. Individual data controllers have a wide margin of appreciation when conducting the section 7(4)-(6) balancing exercise. It follows from that that data controllers generally have a wide discretion as to which particular factors to treat as relevant and the weight to be given to each factor [86]. The assessment by the GMC had been lawful, rational, and could not be faulted [90].

This case will be of interest to all data controllers that deal with ‘mixed personal data’. The Court of Appeal has made it clear that where the personal data of two individuals is mixed, the exercise of balancing their competing interests is a wide and multi-factorial assessment in which the data controller retains a wide discretion not only to consider which factors are relevant but also to determine how much weight they should be given.

Although this case was heard under the old data protection regime, like many DPA 1998 cases much of the reasoning will be pertinent to any considerations conducted under the UK GDPR and DPA 2018. The equivalent provision to section 7 of the DPA 1998 is paragraph 16 of the DPA 2018, Schedule 2, Part 3.

It is interesting to note that paragraph 17 of that Part contains a specific “assumption of reasonableness” in the context of health workers, social workers, and education workers, provided that the relevant tests are met, which was not contained in the DPA 1998. The ‘health data test’ at paragraph 17(2) will be met if a) the information in question is contained in a health record; and b) the other individual is a health professional who has compiled or contributed to the health record or who, in his or her capacity as a health professional, has been involved in the diagnosis, care or treatment of the data subject.