Dr DB v General Medical Council was a data protection case about disclosure of an expert medical report. A patient had complained about his treatment by his GP and was considering a possible claim for clinical negligence. The doctors' regulatory body, the General Medical Council (GMC), investigated the complaint, commissioning a report from an independent expert. The report concluded that the GP’s care had not fallen seriously below the expected standard and on the back of this the GMC decided to take no further action against the GP.
The patient had seen a one-page summary but made a Data Protection Act (DPA) request to the GMC to see the full report, on the basis that it contained his personal data. The GP refused consent, but the GMC decided that, in the interests of fairness and transparency, it should disclose it. The GP brought proceedings to stop disclosure of his own personal data.
The DPA sets out a balancing exercise for the GMC, as "data controller", to assess the conflicting privacy rights of data subjects where the data of two data subjects is "inextricably mixed". The High Court concluded that the GMC had got the balance wrong. Although the report contained the patient's (sensitive) personal data, its real focus was on the GP’s professional competence and reputation. Insufficient weight was given to the GP’s wish to preserve his right of privacy, concern about potential risk to his professional reputation, and express refusal of consent. One of the few reported cases on this issue, Durant v FSA, establishes that, in the absence of consent, the starting point is not to disclose.
The potential use of the report in litigation was also significant. The reason for the request in this case was not to protect the patient's privacy; and obtaining the report by this route meant that the GP would be deprived of protection under the court's procedural rules on document disclosure.
The case is relevant for employers who could reveal information about one employee in responding to a data subject access request from another employee and gives guidance on how to balance those competing interests. The ICO's supplementary guidance on the Employment Practices Code contains a helpful flowchart for employers facing that situation.