B v The General Medical Council

Factual and Procedural Background

The General Medical Council ("GMC") appealed an injunction granted by Soole J on 23 September 2016, which restrained the GMC from disclosing an expert report. The claim proceeded under CPR Part 8 on the basis of no substantial dispute of fact. The Respondent, a general medical practitioner ("Dr B"), had treated a patient ("P") who later complained to the GMC about Dr B's treatment, alleging incompetence leading to a delayed diagnosis of bladder cancer. The GMC commissioned an independent expert report critical of Dr B's care but concluding it was "below" but "not seriously below" the expected standard. The GMC initially sent a summary of the expert's findings to both parties and decided to take no further action. P sought disclosure of the full expert report under the Freedom of Information Act and subsequently under the Data Protection Act 1998 ("DPA"). The GMC refused disclosure citing data protection concerns. Dr B opposed disclosure asserting the report contained his personal data and that disclosure would infringe his privacy rights under Article 8 of the European Convention on Human Rights ("ECHR"). The High Court granted an injunction preventing disclosure, and the GMC appealed.

Legal Issues Presented

1. Whether, in cases of "mixed personal data" involving personal data of both the requester and a third party, there is a rebuttable presumption against disclosure under Section 7 of the DPA.
2. Whether a subject access request ("SAR") made with the dominant purpose of litigation against the other data subject is a weighty factor against disclosure in mixed data cases.
3. Whether the GMC gave adequate consideration to the privacy rights of the objecting data subject (Dr B), including his express refusal of consent and the incremental impact of disclosure beyond a summary already provided.
4. Whether the court below improperly substituted its own assessment for that of the GMC as data controller, and whether it properly balanced the risk of misuse of the report and the rights of the requester (P) to access sensitive personal data.

Arguments of the Parties

Appellant's Arguments (GMC)

• The GMC argued that the expert report constituted mixed personal data of both Dr B and P, and disclosure was lawful and reasonable under the DPA balancing test.
• The GMC maintained there was no presumption against disclosure in mixed data cases and that the judge erred in applying such a presumption at the outset.
• The GMC submitted that the intention of P to use the report in litigation was a relevant but not determinative factor and was properly considered.
• The GMC contended it gave adequate weight to Dr B's privacy rights and refusal of consent and that the risk of misuse of the report by P was low.
• The GMC emphasized the legitimate public interest in transparency of its decision-making process and the complainant’s right to understand the basis of the GMC’s decision.
• The GMC argued that the court below improperly substituted its own view for the GMC’s reasonable assessment as data controller.

Respondent's Arguments (Dr B)

• Dr B contended the report contained his personal data and that disclosure would infringe his privacy rights under Article 8 ECHR.
• He argued there was a starting presumption against disclosure in mixed data cases absent consent, citing Durant v Financial Services Authority.
• Dr B asserted the dominant purpose of P’s SAR was to obtain documents for litigation, which should weigh heavily against disclosure.
• He emphasized the risk to his professional reputation and mental health from disclosure of the report beyond the summary.
• Dr B highlighted that the GMC’s refusal to disclose under FOIA but willingness to disclose under the DPA was inconsistent and that disclosure without a non-disclosure agreement was inappropriate.

Table of Precedents Cited

Court's Reasoning and Analysis

The Court undertook a detailed analysis of the balancing exercise required under Section 7(4)-(6) of the Data Protection Act 1998 in the context of mixed personal data involving both the requester (P) and the objecting data subject (Dr B). The Court considered the competing privacy interests protected by Article 8 ECHR and the statutory purpose of subject access requests to enable data subjects to verify the accuracy and lawful processing of their personal data.

Lord Justice Irwin held that there is a starting presumption against disclosure in mixed data cases, based on the ratio in Durant, that the data controller must not override the privacy rights of the objecting data subject unless it is reasonable to do so. He considered the litigation motive of the requester to be a weighty factor in favor of non-disclosure, reasoning that personal data should be kept confidential to prevent hostile litigation and to respect privacy. He found that the GMC had erred by failing to give adequate weight to Dr B’s privacy rights and the litigation purpose behind the SAR, and by not properly balancing the interests of both parties. The judge below was correct to quash the GMC’s decision to disclose.

Lord Justice Sales dissented, concluding that there is no substantive presumption against disclosure at the outset in mixed data cases and that the GMC’s balancing exercise was lawful and reasonable. He held that the GMC properly considered Dr B’s objections and the litigation motive, but rationally concluded that disclosure was appropriate because the report largely exonerated Dr B and P had a legitimate interest in verifying the accuracy of his personal data in the GMC’s decision. Sales LJ emphasized the wide discretion of data controllers in conducting the balancing exercise and cautioned against courts substituting their own views for those of the data controller.

Lady Justice Arden agreed with Sales LJ’s reasoning and the conclusion to allow the appeal. She acknowledged that litigation motive is a relevant factor but not a disqualifying one and that the data controller must consider all circumstances when balancing rights. Arden LJ also noted the possibility of data controllers seeking undertakings from requesters to restrict use of disclosed data but recognized that litigation itself is not an illegitimate purpose.

The Court reviewed the statutory framework of the DPA, including the relevant provisions of sections 7(1), 7(4)-(6), and the data protection principles, confirming that the balancing exercise must take account of the privacy rights of both data subjects and the legitimate interests of the requester. The Court highlighted the importance of transparency in regulatory decision-making but emphasized that this cannot override privacy rights without a reasonable basis.

In the specific facts, the Court noted that P had already received a summary of the expert report containing sensitive personal data, and the withheld full report contained mainly opinions about Dr B’s professional competence rather than additional sensitive data about P. The Court considered the risk of misuse of the report low but recognized that once disclosed, controlling further dissemination would be difficult. The Court also observed that the GMC’s practice of requiring non-disclosure agreements in other contexts was inconsistent with unconditional disclosure here.

Holding and Implications

The Court’s final decision was to ALLOW THE APPEAL and overturn the injunction granted by the lower court, thereby permitting the GMC to disclose the full expert report to P under the Data Protection Act 1998.

The direct effect is that the GMC’s decision to disclose the report is lawful and reasonable, having properly balanced the privacy rights of Dr B and the legitimate interests of P. No new legal precedent was established beyond clarification of the application of the DPA balancing test in mixed data cases, particularly regarding the role of litigation motive and the absence of a substantive presumption against disclosure. The decision affirms the wide discretion of data controllers in conducting these assessments and the limited role of courts in substituting their own judgments.