Factual and Procedural Background
The appeal concerns the duty of confidence owed by pharmacists to patients when dispensing prescribed drugs, specifically whether pharmacists breach that duty by selling anonymised prescription data to a data company (referred to as Source) which collects information on doctors' prescribing habits for commercial purposes. Source, a UK subsidiary of an American company, purchases anonymised prescription data from pharmacists who enter prescription details into their computer systems and download anonymised information excluding patient identities. Source then aggregates this data to create a database used primarily by pharmaceutical companies to target marketing efforts.
The Department of Health issued a policy document stating that even anonymised prescription data remains confidential and its disclosure without patient consent breaches confidence. Source challenged this view seeking declarations that anonymous data disclosure does not breach confidentiality. At first instance, the application was dismissed by the trial judge, who held that the proposed data use would breach confidence unless patient consent was obtained. Source appealed with leave.
Legal Issues Presented
- What is the scope of the duty of confidence owed by pharmacists to patients in relation to prescription information?
- Does anonymisation of prescription data remove the duty of confidence, permitting pharmacists to disclose such data without breaching confidentiality?
- Is the use or sale of anonymised prescription data by pharmacists or third parties lawful absent patient consent or a public interest justification?
- How do relevant data protection laws, including Directive 95/46/EC and the Data Protection Act 1998, interact with the duty of confidence in this context?
Arguments of the Parties
Appellant's Arguments (Source)
- The information is confidential to the patient only if it can be identified with them; anonymised data is therefore not confidential.
- Even if anonymised data is confidential, its use in anonymised form does not constitute misuse or breach of confidence.
- Any requirement of detriment is not met, as patients suffer no harm from anonymised data use.
- Patient consent is not required for the use of anonymised prescription data.
- The pharmacist’s conscience should not be troubled by participating in the scheme since patient privacy is safeguarded.
Respondent's Arguments (Department of Health and Others)
- The duty of confidence extends to anonymised data because patients did not consent to their information being used for commercial purposes.
- There is a risk, albeit remote, that anonymised data could lead to patient identification.
- Use of prescription data by data companies for targeted marketing is against the public interest as it may inflate NHS drug costs.
- Patient consent cannot be implied for such uses, and public interest does not justify disclosure in this context.
- The Directive 95/46/EC prohibits processing of health data unless specific exceptions apply, which are not met here.
Interveners' Arguments
- The Association of the British Pharmaceutical Industry (ABPI) contends targeted marketing reduces waste and informs prescribers appropriately, thus serving public interest.
- The National Pharmaceutical Association (NPA) highlights practical uses of data for patient safety and stock management.
- The General Medical Council (GMC) and Medical Research Council (MRC) emphasize ethical standards and research needs involving anonymous patient data.
- Lord Lester QC, representing the GMC, argues that anonymised data is not "personal data" under the Directive and that implied consent should be carefully distinguished from public interest justifications.
Table of Precedents Cited
| Precedent |
Rule or Principle Cited For |
Application by the Court |
| Coco v A.N. Clarke (Engineers) Ltd (1969) 86 RPC 41 |
Elements required for breach of confidence: confidential information, obligation of confidence, unauthorised use. |
Used as the conventional starting point for defining the duty of confidence and its scope. |
| Saltman Engineering Co Ltd v Campbell Engineering Co Ltd (1948) 65 R.P.C. 203 |
Confidential information must have the necessary quality of confidence. |
Quoted in Coco to define confidential information. |
| X v Y and Others [1988] 2 AllER 648 |
Use of anonymised confidential information and whether detriment is required for breach of confidence. |
Distinguished by the court as involving information obtained in flagrant breach of confidence, unlike the present case. |
| W v Egdell [1990] Ch 359 |
Scope of duty of confidence owed by psychiatrist to patient. |
Confirmed existence of duty but indicated anonymisation may permit use without breach. |
| Attorney General v Guardian Newspapers (No. 2) [1990] 1 AC 109 (Spycatcher case) |
Broad principles of equitable duty of confidence and protection of information. |
Reaffirmed broad equitable duty of confidence independent of contract, emphasizing conscience of confidant. |
| Smith Kline & French Laboratories (Australia) Limited v Department of Community Services and Health (1991) 99 ALR 679 |
Test for obligation of confidence and scope of use restrictions. |
Supported broad equitable principle that breach requires unconscientious use of information; cautioned against overly broad imposition. |
| Seager v Copydex Ltd [1967] RPC 349 |
Equity principle that confidant must not take unfair advantage of confidential information. |
Applied as a foundational principle in assessing breach of confidence. |
| Moorgate Tobacco Co Ltd v Philip Morris Ltd (No. 2) (1984) 156 CLR 414 |
Equitable jurisdiction based on obligation of conscience arising from circumstances of information communication. |
Quoted to emphasize the conscience-based nature of the duty of confidence. |
| Amber Size and Chemical Co. Ltd. v Menzel [1913] 2 Ch 239 |
Liability for misuse of material part of confidential information. |
Used to illustrate that misuse of part of confidential information can constitute breach. |
| Duchess of Argyll v Duke of Argyll [1967] Ch 302 |
Protection of personal privacy under duty of confidence. |
Referenced to show that breach of confidence includes invasion of personal privacy. |
| Schering Chemicals Ltd v Falkman Ltd [1982] QB 1 |
Public interest and confidentiality balancing. |
Referenced in discussion of public interest considerations in confidentiality cases. |
Court's Reasoning and Analysis
The court began by framing the duty of confidence as an equitable obligation grounded in conscience, following established principles from key authorities such as Coco v A.N. Clarke and Attorney General v Guardian Newspapers (No. 2). The court emphasized that the duty arises when information is imparted in circumstances importing an obligation of confidence and that breach depends on unconscientious use of that information.
The court acknowledged the risk of patient identification despite anonymisation as remote and unsupported by evidence, thus proceeding on the assumption that anonymity could be guaranteed. It rejected the appellant's argument that anonymised information ceased to be confidential, holding instead that the duty of confidence protects the patient's personal privacy, not proprietary interests in the prescription data.
Drawing analogies from precedents involving personal confidences, the court distinguished cases where information was obtained unlawfully (such as X v Y) from the present case where pharmacists lawfully hold the information and propose to anonymise it. It held that anonymisation sufficiently protects patient privacy, thereby removing the risk of breach.
The court further considered data protection law and found that the Directive 95/46/EC does not apply to anonymised data as it is not personal data, relying on recital 26 of the Directive. It also addressed arguments concerning implied consent and public interest, concluding that implied consent should not be conflated with public interest justifications and that the latter was not determinative here.
Ultimately, the court held that pharmacists' participation in the scheme would not breach their duty of confidence provided patient anonymity was safeguarded. The court emphasized that the duty of confidence protects privacy but does not grant patients control over anonymised data, and that any public interest objections should be addressed through regulatory powers rather than distortion of the law of confidence.
Holding and Implications
The court ALLOWED THE APPEAL, declaring that pharmacists do not breach their duty of confidence by disclosing anonymised prescription data to Source for commercial use, provided that patient anonymity is fully protected.
The direct effect of this decision is to permit pharmacists and doctors to participate in anonymised data sharing schemes without risk of successful breach of confidence claims by patients. No new precedent was set altering the fundamental principles of confidentiality; rather, the ruling clarified that anonymisation sufficiently protects patient privacy under the duty of confidence. The court noted that any public interest concerns about such data use should be addressed by appropriate regulatory measures rather than through the law of confidence.