DB v The General Medical Council

Factual and Procedural Background

This case concerns a claim by a General Practitioner ("Appellant") against the General Medical Council ("Defendant") seeking to prevent disclosure of an expert report ("the Report") to a former patient ("Appellee") who requested it under the Data Protection Act 1998 ("DPA"). The Report was obtained by the Defendant as part of an investigation into the Appellee's complaint about the Appellant's professional competence.

The Appellee's request was treated as a data subject access request under section 7 of the DPA. The Appellant contended that disclosure would be unlawful, particularly on the basis it would breach his privacy rights. The claim was brought under the Court’s inherent jurisdiction by a Part 8 procedure, as there was no substantial dispute of fact.

The Defendant notified the Appellee of the proceedings and invited him to join but he declined due to cost and health reasons. The Defendant supported the Appellee's request for disclosure.

Procedurally, the Appellee had complained to the Defendant about the Appellant’s treatment in 2013, alleging incompetence that caused delay in diagnosis. The Defendant investigated under its Fitness to Practise Rules, commissioning an independent expert report in 2014. The Report was critical but concluded the care was "below but not seriously below" expected standards and that most competent practitioners would not have suspected cancer earlier given the clinical signs.

The Defendant sent the Report to the Appellant but did not request comments. The case examiners decided to take no further action and sent both parties a letter with a summary of the expert’s opinion. Following the Appellee’s telephone request for the full Report, the Defendant advised him to make a formal request under the Freedom of Information Act 2000 and/or the DPA.

The Appellee’s solicitors submitted a completed request form listing the Report but did not specify the basis of the request. The Defendant processed the request under both FOIA and DPA, ultimately refusing FOIA disclosure but treating it as a DPA subject access request requiring a fee.

The Defendant invited the Appellant’s views, who objected to disclosure on grounds that the Report was primarily his personal data, that the request was being used for litigation purposes, and that disclosure would breach section 35B(2) of the Medical Act 1983.

An internal review by the Defendant’s Information Access Manager concluded the Report contained mixed personal data of both parties, but that disclosure was fair and lawful and necessary for transparency. The Defendant decided to disclose the Report despite the Appellant’s refusal of consent.

The Appellant’s solicitors challenged this decision, emphasizing the Report’s focus on the Appellant, confidentiality expectations, potential damage to reputation, and the litigation purpose of the request. The Defendant maintained its position following further internal review.

The Defendant agreed not to disclose pending resolution by the Court. The Appellant issued judicial review proceedings, asserting the Defendant failed properly to balance privacy rights, gave insufficient weight to the refusal of consent, and ignored the litigation purpose of the request.

The Appellant’s evidence emphasized his long unblemished record, concerns about misuse of the Report, and that only a summary was normally disclosed when no further action was taken. The Defendant relied on the mixed nature of the data, the Appellant’s lack of reasonable expectation of confidentiality from the patient, and the public interest in transparency.

Legal Issues Presented

1. Whether the Defendant lawfully conducted the balancing exercise under section 7(4)-(6) of the Data Protection Act 1998 in deciding to disclose the expert Report to the Appellee despite the Appellant’s refusal of consent.
2. The proper weight to be given to the Appellant’s privacy rights, including professional reputation and confidentiality expectations, in the balancing exercise.
3. Whether the purpose of the Appellee’s request, notably its use in litigation, is a relevant factor in the balancing exercise under the DPA.
4. The role of the Defendant’s interests in transparency and equality of treatment in the disclosure decision.

Arguments of the Parties

Appellant's Arguments

• The Report primarily constitutes the Appellant’s personal data, not the Appellee’s.
• The Appellant had a reasonable expectation that the full Report would remain confidential absent further action, supported by the Defendant’s usual practice of only providing summaries.
• Disclosure would damage the Appellant’s professional reputation and mental health.
• The request was made for litigation purposes, circumventing the proper procedural protections under CPR 31, including restrictions on use of disclosed documents.
• The Defendant’s decision failed to give adequate weight to the Appellant’s refusal of consent as required by s.7(6)(d) DPA.
• The Defendant wrongly relied on transparency and equality as justifications for disclosure, contrary to its own practice and statutory powers.

Defendant's Arguments

• The Report contains mixed personal data of both Appellant and Appellee, including sensitive health information of the Appellee.
• The Appellant did not have a reasonable expectation that the Report would not be disclosed to the Appellee under a valid subject access request.
• The summary already disclosed to the Appellee mitigates any risk of reputational damage; disclosure of the full Report would not cause incremental harm.
• Concerns about misuse or wider dissemination by the Appellee are speculative and unsupported by evidence.
• Refusal to disclose would deprive the Appellee of a fuller understanding of the treatment he received and the reasons for closure of his complaint.
• There is a legitimate public interest in transparency of the Defendant’s complaint investigation process distinct from FOIA or Medical Act disclosures to the public.
• The Defendant carried out an appropriate balancing exercise under s.7 DPA, properly considering all relevant factors including privacy rights and legitimate interests.

Table of Precedents Cited

Court's Reasoning and Analysis

The Court conducted a detailed review of the Defendant’s balancing exercise under s.7(4)-(6) DPA, emphasizing the primacy of privacy rights derived from Article 8 ECHR and common law. The Court identified that the Defendant had failed to apply the rebuttable presumption against disclosure in the absence of consent, as established in Durant.

The Court found that the Defendant gave inadequate weight to the Appellant’s privacy rights, particularly his professional reputation and confidentiality expectations. Although the Report included the Appellee’s sensitive data, its primary focus was on the Appellant’s professional conduct.

The Court rejected the Defendant’s argument that the Appellant had a reasonable expectation of disclosure to the patient, holding that the reasonable expectation was of a lawful balancing exercise respecting mixed personal data and confidentiality, reinforced by the Defendant’s usual practice of only disclosing summaries in such cases.

The Court noted that the Defendant failed to properly consider the Appellant’s express refusal of consent as a distinct and important factor under s.7(6)(d).

Significantly, the Court held that the Defendant did not adequately account for the litigation purpose of the Appellee’s request. This was a weighty factor favoring refusal, as the proper route for disclosure for litigation purposes is via court procedures (CPR 31), which provide safeguards absent in the DPA process.

The Court also found that the Defendant overstated the importance of transparency and equality of treatment, especially given the absence of any policy to disclose full expert reports to complainants in no further action cases.

Overall, the Court concluded that the Defendant’s decision was unlawful because it did not fairly balance the competing privacy rights and legitimate interests involved, giving undue weight to the Appellee’s interests and insufficient weight to the Appellant’s privacy and refusal of consent.

Holding and Implications

The Court’s final ruling was that the claim by the Appellant must succeed. The Defendant’s decision to disclose the expert Report to the Appellee without the Appellant’s consent was unlawful.

As a result, disclosure of the Report is restrained pending further order. The Court invited submissions on the appropriate form of order and consequential relief.

This decision directly affects the parties by protecting the Appellant’s privacy rights against disclosure of mixed personal data in the absence of consent and proper balancing. It underscores the importance of applying the s.7(4)-(6) balancing exercise rigorously, especially where litigation purposes are involved.

No new precedent was established beyond the application of existing principles, but the judgment provides detailed guidance on the Court’s approach to mixed data subject access requests and the weight to be given to refusal of consent and litigation motives.