In the recent case of Dr DB v The General Medical Council a doctor successfully challenged the GMC’s decision to disclose to a patient an expert report into the doctor’s fitness to practice. The judgment provides some useful guidance on the balancing exercise to be performed in mixed data cases.

The Facts

Following a missed diagnosis of bladder cancer, a patient (“P”) contended that his GP (“DB”) had dealt with him incompetently and thereby delayed an accurate diagnosis by a year. The General Medical Council (“GMC”) commenced an investigation of DB’s fitness to practice and instructed an independent expert to review the matter. The expert prepared a report which concluded that the GP’s care had fallen below, but not seriously below the expected standard. Consequently, the GMC concluded that no further action should be taken against the GP. Having received a one page summary of the report, P requested a full copy in order to investigate a potential claim for clinical negligence. DB refused consent but the GMC determined that it should disclose the report to P. DB then brought proceedings to prevent disclosure.

The Law

In a case of personal data held by others (“data controllers”), the relevant law is set out in the Data Protection Act 1998 (the “DPA”). The DPA gives effect to the EU Data Protection Directive.

By section 7(1) DPA, P (as a “data subject”) is given the right of access to his personal data and may make a subject access request. However, the report contains personal data relating not only to P but also to DB. In such cases, section 7(4)-(6) DPA provides that a balancing exercise must be carried out and sets out some non-exhaustive factors that the data controller (the GMC) must consider. These include any duty of confidentiality owed to DB and the fact that DB has expressly refused consent. Where consent has not been given there is a rebuttable presumption against disclosure (Durant v FSA).

The judge described the court’s role in reviewing the balancing exercise as being more intensive than the traditional Wednesbury test. The GMC’s decision involves an interference with fundamental rights and is therefore to be subject to ‘anxious scrutiny’.

The GMC Decision

In concluding that the report should be disclosed, the GMC considered: the sensitive nature of P’s medical records, the conclusions on DB’s standard of case, the independence of the reporting expert, the GMC’s legitimate interest in fairness and transparency, P’s legitimate interest in seeing the document, the minimal risk to DB’s reputation and the lack of evidence to suggest that P would misuse the data in the report.

DB on the other hand pointed to his unblemished disciplinary history over 25 years of practice, his concern that P might publish the report online, the absence of his own comments within the report and his expectation that the report would be kept confidential following the decision to take no further action.

The Decision

The judge concluded that the GMC had performed the balancing exercise incorrectly and the report should not be disclosed to P.

In particular, he commented that:

  1. In the absence of consent, the starting point should have been a presumption against disclosure.
  2. The report’s real focus is on DB’s professional competence and the GMC failed to give adequate weight to DB’s status as a data subject.
  3. In performing the balancing exercise, the GMC attached undue importance to transparency and equality of treatment.

In addition, the GMC failed to take account of the fact that the purpose of the request was to use the report in the intended litigation against DB. The judge described how the significance of this factor was two-fold. Firstly, the information was not being sought for the purpose contemplated by the Directive, namely, to protect P’s privacy by ensuring the accuracy of the personal data. Secondly, by disclosing the report in this way, DB would be deprived of the protection provided by the civil procedure rules on disclosure.

General Guidance

The Judge was invited to provide some guidance to the GMC for future mixed data cases of this type. He advised that each case should be considered on its merits but stated the following:

  1. “it is essential to keep in mind that the exercise involves a balance between the respective privacy rights of data subjects;
  2. in the absence of consent, the rebuttable presumption or starting point is against disclosure (Durant). Furthermore the express refusal of consent is a specific factor to be taken into account;
  3. if it appears that the sole or dominant purpose is to obtain a document for the purpose of a claim against the other data subject, that is a weighty factor in favour of refusal, on the basis that the more appropriate forum is the Court procedure under CPR 31.”

Comment

The case provides an interesting example of the challenges faced by data controllers in mixed data cases. In ‘three way’ cases such as these, the data controller is likely to be challenged irrespective of the decision they take. Nonetheless, in relying on the dicta from Durant, the case highlights the difficulty in obtaining disclosure once a joint data subject has refused consent to the release.

The case provides an interesting example of the challenges faced by data controllers in mixed data cases. In ‘three way’ cases such as these, the data controller is likely to be challenged irrespective of the decision they take. Nonetheless, in relying on the dicta from Durant, the case highlights the difficulty in obtaining disclosure once a joint data subject has refused consent to the release.