GMC failed to give adequate weight to doctor's privacy rights (High Court)

Under sections 7 and 8 of the Data Protection Act 1998 (DPA 1998) a data subject has a right, on making a request to the data controller, to be informed whether personal data of which he is the data subject is being processed by or on behalf of a data controller. If so, the data subject also has a right to:

The claimant doctor brought a claim against the defendant, the General Medical Council (GMC), to prevent it from disclosing to his former patient, pursuant to a request under the DPA, an expert report obtained by the GMC for the purpose of investigating the patient's complaint concerning the doctor's professional competence.

The patient had complained to the GMC about his treatment by the doctor which he had alleged had resulted in a delay to his cancer treatment.

The GMC had commenced an investigation of the doctor's fitness to practise and had instructed an independent expert. The expert's report had been critical of the doctor's care but had concluded that most GPs would not have suspected cancer.

The GMC sent a summary of the report to the patient and he applied for a copy of the report. His application was treated by the GMC as a request by him as a data subject under section 7 of the DPA 1998.

The doctor did not consent to the report's disclosure on the basis that it was his personal data alone and that the request was being made with a view to litigation.

The GMC undertook a balance of interests test and concluded that the report contained the patient's personal data and should be disclosed to him.

The doctor submitted that compliance with the patient's request was unlawful and breached his right to privacy as a data subject. He argued that disclosure would damage his professional reputation.

Judgment for the claimant.

The court held that the GMC had got the balance of interests test wrong. In the absence of consent, it should have started with a presumption against disclosure (see Durant v FSA (Disclosure) [2003] EWCA Civ 1746). The GMC had given no adequate weight to the doctor's status as a data subject or the privacy right which he had in the report.

Whilst containing the patient's personal data, the report's real focus was on the doctor's professional competence. The GMC had focused on the patient's rights and the issue of transparency and equality. The decision took no adequate account of the doctor's express refusal of consent or of the fact that the purpose of the request was to use the report in the patient's intended litigation against the doctor. These factors pointed towards refusal of the request. The GMC's decision was therefore unlawful.

The court also gave the following guidance on how to conduct the balancing exercise in mixed data cases:

The decision of the High Court is not a surprising one and provides some very helpful guidance on conducting the balancing exercise in mixed data cases.

DB v GMC [2016] EWHC 2331 (QB) (23 September 2016) (Westlaw).