England and Wales High Court (Queen's Bench Division) Decisions

IN THE HIGH COURT OF JUSTICE
QUEEN'S BENCH DIVISION
MANCHESTER DISTRICT REGISTRY

		Liverpool Civil and Family Court
		23/09/2016

Mr Justice Soole :

1. This is the hearing of a claim by the Claimant General Practitioner, anonymised as Dr DB (DB), against the General Medical Council (GMC) to prevent it from disclosing to his former patient (P), pursuant to his request under the Data Protection Act 1998 (DPA), an expert report (the Report) obtained by the GMC for the purpose of investigating P's complaint concerning his professional competence.
2. P's application for the Report was treated as a request made by him as a 'data subject' under s.7 of the DPA. DB contends that compliance with the request is unlawful; in particular on the basis that it breaches his right of privacy as a data subject.
3. The claim is made under the inherent jurisdiction of the Court to grant declaratory relief, using the CPR Part 8 procedure as appropriate for a claim where there is no substantial dispute of fact.
4. On considering the papers before the hearing I was concerned that P, whose interests are directly affected by the claim, is not a party to the proceedings : cf. Rolls Royce plc v. Unite the Union [2009] EWCA Civ 387 per Aikens LJ at para.120 point (6). On further enquiry, correspondence between the GMC and P's solicitors showed that they are aware of the proceedings. I concluded that the two-day hearing should proceed but that P through his solicitors should be given formal notice of the proceedings (including the documents with some necessary redactions) and the opportunity to be joined as a party and thus to make submissions.
5. In response to such notice, by letter dated 22.7.16 P's solicitors (WH Law LLP) advised that he did not wish to be joined, citing both the cost and his state of health. I have concluded that his interests are sufficiently protected by the supportive stance which the GMC has taken in respect of his request and these proceedings.

Factual background

6. In September 2013 P was diagnosed as suffering from cancer of the bladder. On 8.11.13 he complained to the GMC about his treatment by DB on 16.10.12. He contended that DB had examined and dealt with him incompetently, with the consequence that there had been an avoidable delay of one year in the diagnosis.
7. The GMC commenced an investigation of DB's fitness to practise (FTP) in accordance with its regulatory functions and procedures under the GMC Fitness to Practise Rules 2004. For that purpose it instructed an independent expert to review the matter and prepare an opinion. The expert produced the 22-page Report dated 14.5.14.
8. The Report was critical of the care provided by DB in a number of respects, concluding that this fell below – 'but not seriously below' - the expected standard. However it concluded that most reasonably competent General Practitioners would not have suspected bladder cancer given (i) the absence of a history of blood in the urine and (ii) the negative results of the urine test which DB had ordered on 16.10.12.
9. On 19.5.14 the GMC sent a copy of the Report to DB. The accompanying letter advised that the Investigating Officer would now be submitting the case for decision by the case examiners. The letter made no request for DB to comment on the Report, nor did he do so.
10. On 17.7.14 the GMC wrote to P and DB by separate letters advising that the case examiners (one medical, one lay) had decided to conclude the case with 'no further action'. To each letter the GMC attached, by Annex A, the reasons given by the case examiners for their decision. The Annex included a short summary of the expert's comments, of approximately one page. This summary included the statements of opinion that the care provided by Dr DB was 'below but not seriously below' the expected standard and the conclusion to which I have referred.
11. Following P's telephone request for a copy of the Report, the Investigation Officer by letter dated 8.9.14 advised him to submit the request to the GMC's 'FOIA Team', referred him to the Freedom of Information Act 2000 (FOIA) and supplied a copy of the GMC's 'Information Request Form' for completion and return.
12. By letter dated 11.9.14 P's solicitors returned the completed form, attaching a requested 'List of Documents'. The first listed document was the Report. The form and accompanying letter made no reference to FOIA or DPA. By letter of the same date P's solicitors notified DB that they were acting for P under a conditional fee agreement, attaching a Notice of Funding.
13. By letter dated 16.9.14 the GMC replied that it was dealing with the request under both FOIA and the DPA and that a DPA request required a statutory fee of £10. The letter noted that there '… may be some information which we cannot release to you under the FOIA and/or DPA…'. P's solicitors sent the fee the following day.
14. By letter dated 25.9.14 the GMC invited DB's views on the request for disclosure '… given that the report concerns you, as well as [P]'.
15. By e-mail dated 9.10.14 the GMC advised P's solicitors that the request under FOIA was refused and that a request for personal information fell under the data subject access provisions of the DPA.
16. By letter dated 17.10.14 DB's solicitors (BLM) advised that he did not consent to the disclosure of the Report. They submitted in particular that the Report constituted the 'personal data' of DB alone; and that the DPA request was being used as a vehicle for disclosure with a view to litigation or further complaint, contrary to certain observations made in Durant v. FSA [2003] EWCA Civ 1747. They also objected to disclosure under section 35B(2) of the Medical Act 1983 (MA 1983). That provision empowers the GMC, if they consider it in the public interest to do so, to publish or disclose information which relates to a practitioner's fitness to practise.
17. On the same date (17.10.14) an internal memorandum of the GMC submitted the 'DPA request' and DB's response to Mr Julian Graves (Information Access Manager) and asked him to carry out '… a 'balance of interests test', as provided for in the legislation…' so as to determine whether the Report should be released to P.
18. By his Memorandum dated 31.10.14 Mr Graves advised of his conclusions in particular that:
    (1) the Report focused on the interactions between P and DB and should be regarded as P's personal data (save for the section concerning Dr DB's CV) for the purposes of the DPA;
    (2) it could not be doubted that the information was being sought to further a potential claim for clinical negligence against DB;
    (3) his task was to balance the interests of both parties in accordance with DPA s.7(4);
    (4) on balance it would be fair and lawful and not in breach of the DPA's Data Protection Principles (DPP) to disclose the report to P;
    (5) section 35B of the Medical Act 1983 was not the appropriate route when DPA s.7 was engaged.
19. In reaching his conclusion, Mr Graves recognised the validity of the concern that the Report was being sought in order to pursue litigation but doubted if it would assist P in any legal action, given that it was 'largely supportive' of the actions he had taken. Furthermore, taking account of the '… transparency of our decision making process, I feel there is a strong case to justify providing [P] with a document which played a key role in the GMC's decision to close his complaint at an early stage. There is certainly the potential for [P] having considered the comment of the expert, to seek a Rule 12^[1] review with the GMC. His opportunity for doing this without sight of this key piece of evidence will undoubtedly be hampered.'
20. By letter dated 12.11.14 the GMC reported his conclusion to BLM and advised that, in the absence of further reply, the Report would be disclosed on 21.11.14.
21. By reply dated 21.11.14 BLM in particular stated that (i) it did not accept that the Report constituted the sole personal data of P and referred back to Durant (ii) the GMC had unfairly prioritised its and P's interests over DB's privacy rights which included the protection of his professional reputation (iii) reiterated the litigious purpose of P's request; and submitted that an unfair balance had been struck.
22. By substantive reply dated 13.2.15 Mr Graves advised that the GMC's view remained that this was the joint personal data of DB and P; that the balancing exercise had been appropriately carried out; and that he had asked a colleague to undertake a review of his original balancing decision. Having done so, the conclusion was unchanged. The letter referred to Article 8/the DPP and recognised the need to balance the rights and interests of both parties. It also emphasised the GMC's legitimate interest in transparency and concluded 'Failure to disclose the findings of an independent expert would most likely be a breach of the Human Rights Act in terms of obligations to protecting the health, as well as the rights and freedoms of the data subject (i.e. [P]'s). The report contains data that relates to both parties,… – By not disclosing to one party, we could be said to be biased and acting against the interests of the party, in contravention of our obligations under DPA/HRA.' Subject to any further representations, the Report would be disclosed on 27.2.15.
23. Following an agreed extension of time, BLM replied on 6.3.15, citing further authority and submitting that the Report primarily constituted DB's personal data and that its 'main focus' was his involvement in P's care, rather than P. If and to the extent that the GMC's legitimate interests in openness and transparency were engaged, these had been met by the summary it had disclosed.
24. By his reply dated 10.6.15 Mr Graves stated that the balancing exercise had reached the appropriate conclusion and had not breached the DPP 'in terms of [DB]'s DPA rights'. The Report would be disclosed by close of business on 20.6.15.
25. The GMC subsequently agreed not to disclose the Report until the issue was resolved by the Court. On 26.6.15 BLM served a pre-action protocol letter for judicial review under CPR 54.
26. The letter stated that the GMC's conclusion had failed to have any or any proper regard for the fact that the Report contained DB's personal data and therefore, at least, constituted the mixed personal data of both individuals. The letter continued that the balancing exercise should in particular have taken account of (i) DB's position as the focus of the Report (ii) its confidentiality and DB's expectation thereof (iii) the damage to DB's professional reputation from disclosure; including the loss of control over its circulation and the risk of its misuse (iv) the fact that the criticisms in the Report had been found not to constitute issues of sufficient concern to warrant FTP proceedings (v) the motive for disclosure, namely the use of the Report in a proposed claim in negligence, rather than the protection and safeguarding of P's privacy rights.
27. The GMC's formal response (10.7.15) reiterated the acceptance by Mr Graves (13.2.15) that the Report contained the joint personal data of P and Dr DB and that, in accordance with Article 8 and s.7(4)-(6) the privacy rights and freedoms of both P and DB had to be balanced. The letter listed 7 non-exhaustive factors taken into account in the decision to disclose, namely (i) the Report contained P's sensitive personal data relating to his medical records and the complaint as to his health (ii) and favourable/unfavourable conclusions on DB's standard of care in treating P (iii) and was prepared by independent expert; so both parties should have sight of it (iv) GMC had a legitimate interest in ensuring fairness and transparency in its procedures (v) P had a legitimate interest in seeing the document which heavily influenced the final decision regarding his complaint (vi) there was minimal risk to DB's reputation, given the respects in which his treatment is considered to be of a reasonable standard (vii) there was no evidence to suggest that P would 'misuse' the data in the Report.
28. These proceedings were issued on 10.11.15. The Particulars of Claim and Defence identified the particular factors justifying refusal of disclosure in terms broadly reflecting the pre-action protocol correspondence. The Defence also contended that the intention of a requester to use the information in furtherance of litigation was not itself a basis for refusing the request.
29. In his witness statement for this claim (29.9.15) DB points amongst other factors to his unblemished disciplinary history in the course of nearly 25 years practice; to his concern that P might misuse the Report by publishing it to the world at large, e.g. online, causing damage to his professional reputation and mental health. He states that the Report contains a much more detailed and '…potentially inflammatory analysis of the way I treated [P]'; and does not contain (because he was not asked) his own comment and disagreement with the expert's analysis. He understands that the provision of a summary was consistent with the GMC's usual approach. His expectation was that, unless the GMC determined to commence FTP proceedings or was minded to disclose it pursuant to its powers under s.35B(2) of MA1983, it would be kept strictly confidential. As to s.35B(2) disclosures, he states that the GMC routinely requires recipients of material disclosed on public interest grounds to agree to a non-disclosure agreement (NDA) which restricts the use to be made of the material.

The law

Outline

30. At the heart of this case are the competing privacy rights of P and DB in the personal data contained in the Report. It is now common ground that their personal data are inextricably 'mixed' therein.
31. The privacy rights are derived from ECHR Article 8 and the common law; and then protected in the context of personal data held by others ('data controllers') through EU Directive 95/46/EC and its domestic enactment in the DPA.
32. In these circumstances where there cannot be compliance with a data subject's request without disclosing information relating to another data subject, the DPA provides a balancing exercise : s.7(4)-(6) to be considered below.
33. It is well established that the DPA (including its DPP) is compliant with Article 8 and the Directive: see e.g. R (Catt) v. Commissioner of Police for the Metropolis [2015] UKSC 9 at [12]. Accordingly the parties agree that the focus is on the s.7(4)-(6) balancing exercise; but that this must be considered in the context of the rights protected by the Article 8/common law and the Directive/DPP.

The Court's role

34. As to the Court's role in its review of the balancing exercise, it is agreed that this is more intensive than in the traditional Wednesbury test. Thus, whilst it is not for the Court to substitute its own view for that of the data controller, the latter's decision involves an interference with fundamental rights (including data protection and privacy) and is to be subject to 'anxious scrutiny': see Durant paras. 58-61; also Roberts v Nottinghamshire NHS Health Trust [2008] EWHC 1934 per Cranston J at para. 12.

Directive/DPA

35. The starting point is the EU Directive, to which the DPA gives effect. Its primary objective is to protect individuals' fundamental rights, notably the right to privacy and accuracy of their personal data held by others ('data controllers'): Durant per Auld LJ at para.4; see also Buxton LJ : 'The guiding principle is that the Act, following Directive 95/46, gives rights to data subjects in order to protect their privacy' (para.79); also YS v. Minister voor Immigratie [2015] 1 CMLR 18 to similar effect.
36. As to definitions, 'data' means 'information' which is being 'processed' etc. by the data controller (GMC). 'Personal data' means 'data which relate to a living individual who can be identified – (a) from those data…and includes any expression of opinion about the individual…' 'Sensitive personal data' includes information as to the physical or mental health or condition of the data subject. A 'data subject' means a person who is the subject of personal data (ss.1,2).
37. By DPA s.4(4) the data controller has the duty to comply with the DPP (as defined by Schedule) in relation to all personal data with respect to which he is the data controller.
38. In this case the relevant DPP is the first principle that : 'Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless – (a) at least one of the conditions in schedule 2 is met…'.
39. As to Schedule 2 the GMC relies on Conditions 3 and 6 that :

3 'The processing is necessary for compliance with any legal obligation to which the data controller is subject, other than an obligation imposed by contract.'

6 'The processing is necessary for the purposes of legitimate interests pursued by the data controller or by a third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.'

40. By s.7(1) a data subject is given the right of access to his personal data. However this right is qualified by the balancing exercise where compliance with the request will involve disclosure of information relating to another data subject: s.7(4). Thus the DPA imposes on data controllers the requirement to respect the privacy of others whose names may figure in the personal data of an individual seeking access to it (Durant per Auld LJ at para.4; see also Directive Article 13.1^[2]).
41. Thus under s.7 :

'(1) an individual is entitled –

(a) to be informed by any data controller whether personal data of which the individual is the data subject are being processed by or on behalf of that data controller

(b) if that is the case, to be given by the data controller a description of –

(i) the personal data of which that individual is the data subject,

(ii) the purposes for which they are being or are to be processed, and

(iii) the recipients or classes of recipients to whom they are or may be disclosed,

(c) to have communicated to him in an intelligible form –

(i) the information constituting any personal data of which the individual is the data subject, and

(ii) any information available to the data controller as to the source of those data…',

42. Section 7(4) then provides the balancing exercise :

'Where a data controller cannot comply with the request without disclosing information relating to another individual who can be identified from that information, he is not obliged to comply with the request unless –

(a) the other individual has consented to the disclosure of the information the person making the request, or

(b) it is reasonable in all the circumstances to comply with the request without the consent of the other individual.

43. Section 7(6) then identifies four non-exhaustive factors in the balancing exercise. Thus :

'… for the purposes of subsection 4(b)… regard shall be had, in particular, to

(a) any duty of confidentiality owed to the other individual,

(b) any steps taken by the data controller with a view to seeking the consent of the other individual,

(c) whether the other individual is capable of giving consent, and

(d) any express refusal of consent by the other individual."

44. In the absence of consent there is a rebuttable presumption or starting point against disclosure : Durant per Auld LJ at para.55^[3].
45. Section 7(9) provides the applicant with a Court remedy in the event of a refusal of the request :

'If a court is satisfied on the application of any person who has made a request under the foregoing provisions of this section that the data controller in question has failed to comply with the request in contravention of the provisions, the court may order him to comply with the request.'

46. I return to the four non-exhaustive factors identified in s.7(6).
    As to (a) – 'any duty of confidentiality owed to the other individual' – this theoretically raises the question of whether the 'duty of confidentiality' in a statute passed in 1998 embraces the duty not to misuse private information as subsequently formulated in Campbell and the earlier decision of the Court of Appeal in A v. B [2003] QB 195. It is unnecessary to decide that point since there is no dispute that the DPP obligations to process personal data 'lawfully' (Schedule 1 Part 1 para.1) and in compliance with the data controller's 'legal obligation' (Schedule 2, condition 3) and 'the rights and freedoms or legitimate interests of the data subject' (Schedule 2, condition 6) include the Article 8/common law right of privacy; which must therefore be taken in to account in the s.7(4) balancing exercise.
47. Returning to s.7(6), factors (b) and (c) do not arise. As to (d), DB has expressly refused his consent.
48. With one exception, there is essential agreement between Counsel that the DPP^[4] – in this case, at least – otherwise adds nothing to the balancing exercise under s.7(4). As to the obligation to process information 'fairly', I need not set out the detailed provisions on the procedural requirement of fairness (Schedule 1 part II para.2). Ms Proops ultimately did not pursue any point on these provisions. As to substantive fairness, the parties agree that this requires a fair balancing of the interests of the parties.
49. Condition 6 includes the legitimate interests of the data controller. The parties disagree as to whether this entitles and/or provides additional support for the GMC to take account of the factors of transparency and equality.

Privacy

50. The aspect of privacy which is engaged in this case is the protection of private information. Misuse of private information is now a distinct cause of action in tort which reflects the common law's absorption of Article 8 into the established cause of action for breach of confidence: Vidal-Hall v. Google [2015] EWCA Civ 311; Campbell.
51. The parties agree that the mixed personal data in the Report constitutes private information of both P and DB. As to P, it concerns his medical condition and treatment. As to DB, his professional competence and reputation: see e.g. Mikolajova v. Slovakia ECHR Application no. 4479/03 (2011). The consequence is that the GMC as data controller is required to balance the privacy rights on each side : see the discussion on this balancing exercise per Auld LJ at para. 66; also per Buxton LJ at para. 80.
52. In Campbell v. MGN Newspapers [2004] 2 AC 457 the House of Lords said that the touchstone of private life is whether in respect of the disclosed facts the person in question had a reasonable expectation of privacy: see Lord Nicholls at para. 21 and Baroness Hale at paras. 134-5 and 137. This is an objective test.
53. Whilst accepting that the Report's information about DB is private information, Mr Hopkins submits that he did not have a reasonable expectation that the Report would be kept from P. On the contrary, his reasonable expectation should have been that it would be disclosed to him (although not to the public generally) if requested under s.7. In disagreement Ms Proops in particular points to the GMC's practice of providing only a summary of the expert report to the complainant in the event of deciding to take no further action – as in this case.
54. As to interference with the right of privacy, Ms Proops points to South Lanarkshire Council v. Scottish Information Commissioner [2013] 1 WLR 2421 where Baroness Hale emphasised that the word 'necessary' (i.e. in Article 8.2; first DPP, schedule 2, condition 6) requires, in accordance with Community law, that the interference with the right must be proportionate to the achievement of a legitimate aim; and so that 'A measure which interferes with a right protected by Community law must be the least restrictive for the achievement of a legitimate aim.': p.2433H. Mr Hopkins seeks to deploy this point in his favour, citing R (Lord) v. SSHD [2003] EWHC 2073 (Admin) where Munby J (as he then was) agreed with the s.7 applicant that the exception to disclosure in s.7(4)(b) should be construed narrowly; and only if it can be shown that the rights and freedoms of others will be interfered with; and then only if and to the extent that the restriction is a 'necessary measure' : paras. 137 and 147.

Purpose of request

55. In its review of s.7 the Court of Appeal in Durant emphasised that '…the intention of the Directive, faithfully reproduced in the Act, was to enable an individual to obtain information about himself; not an entitlement to be provided with documents as such. The information may be in documentary form (Auld LJ at para. 26); and that its purpose is '…to enable him to check whether the data controller's processing of it unlawfully infringes his privacy and, if so, to take such steps as the Act provides… to protect it' (para. 27).
56. There is no dispute that an applicant under s.7 has no need to state the purpose of his request: see e.g. Roberts at paragraph 5 per Cranston J. However there is controversy as to whether and if so to what extent the purpose or purposes (as known or reasonably inferred by the data controller) may be taken into account in the balancing exercise. There are conflicting observations in the authorities.
57. In Durant Auld LJ observed (obiter) of s.7: 'It is not an automatic key to any information, readily accessible or not, of matters in which he may be named or involved. Nor is it to assist him, for example, to obtain discovery of documents that may assist him in litigation or complaints against the parties.' (para.27); followed at first instance in Dawson-Damer v. Taylor-Wessing LLP [2016] 1 WLR 28 (appeal decision pending).
58. Conversely in Dunn v. Durham County Council [2013] 1 WLR 2305 Maurice Kay LJ said (obiter) in a case concerning disclosure under CPR 31 : "I do not doubt that a person in the position of the claimant is entitled – before, during or without regard to legal proceedings – to make an access request pursuant to section 7 of the Act. I also understand that such a request prior to the commencement of proceedings may be attractive to prospective claimants and their solicitors. It is significantly less expensive than an application to the court for disclosure before the commencement of proceedings pursuant to CPR 31.16. Such an access may result in sufficient disclosure to satisfy the prospective claimant's immediate needs..' : see also Gurieva v. Community Safety Development Ltd [2016] EWHC 643 (QB) per Warby J at paras.67-72 ('It is commonly said that the subject access regime under the DPA is 'purpose blind'); also Kololo v. Commissioner of Police [2015] 1 WLR 3702 and Zaw Lin v. Commissioner of Police [2015] EWHC 2484 (QB).
59. The Defence pleads that the requester's intention to use the information in furtherance of litigation is not of itself a reason for refusing the request. Mr Hopkins accepted, rightly in my judgment, that it was a factor which could be taken into account in the balancing exercise. However he submitted it should be given no significant weight in this case.

The submissions

60. Ms Proops submits that the GMC's balancing exercise has failed to give any or any adequate weight to DB's right of privacy and in particular to the concerns which have led to his express refusal of consent; has given undue weight to P's request, in particular taking no or no adequate account of the litigation purpose for which the request is made; and has wrongly taken account of the factor of transparency.
61. As to DB's interest, she in particular submits that : the focus of the Report is on him, not P. P's personal data is incidental; DB's reasonable expectation was that the full Report would not be disclosed in circumstances where no further action was to be taken; disclosure of the Report would be damaging to his present professional reputation (and mental health); and, in contrast to the protection in the disclosure process (CPR 31.22), disclosure under s.7 would impose no restraint on P's use of the document.
62. Ms Proops contrasts the GMC's stance in refusing the application under the FOIA and MA 1983, s.35(B). As to the latter, the GMC has decided against exercise of its power 'in the public interest' to publish information concerning this practitioner. She also points to the unchallenged evidence that the GMC's practice was to make a s.35B disclosure subject to a NDA (Non-Disclosure Agreement).
63. As to FOIA, the GMC's refusal under that statute (9.10.14) explained that the aim of the Act was to make information available to the general public; and relied on an exemption whereby the duty does not arise if to do so would breach any of the principles of the DPA, i.e. in this case the principle that the processing must be fair and lawful (FOIA s.40(5)(b)(i)). Ms Proops submitted that disclosure to P, without the constraints against wider disclosure afforded by CPR 31, was inconsistent with the GMC's refusal under both statutes.
64. As to P's interest, his s.7 request was not being made in order to ensure that his personal data is accurate (compare the Directive and Durant) but for the purpose of litigation against DB, thus sidestepping the requirements and constraints of CPR 31; and in particular CPR 31.22.
65. As to transparency, this was not a factor to be taken into account, particularly given the GMC's contrary practice in cases where no further action was taken.
66. In response Mr Hopkins submits in particular that:

(1) the Report focuses equally on P and DB and includes P's sensitive personal data concerning his health and treatment;

(2) DB did not have a reasonable expectation that the Report would not be disclosed in response to a request by P under s.7; in contrast to his reasonable expectation that it would not be made publicly available;

(3) Any risk of damage to professional reputation already exists by virtue of the summary provided to P. There is no real basis to conclude that the disclosure of the Report would have an incremental detriment to such an extent that it would be unreasonable to order its disclosure;

(4) the concern that P would disclose the report to others e.g. online or to the media is purely speculative. There is no evidence of misuse of the summary which had been provided to P;

(5) the contention as to DB's mental health is no more than assertion;

(6) refusal to disclose would deprive P of expert insight into the treatment which he received and a fuller understanding of the criticisms contained in the summary and of why the complaint was dismissed. For that purpose Mr Hopkins conducted an analysis of the contents of the Report;

(7) there is a legitimate and weighty public interest in transparency concerning the GMC's investigation of the complaint. FOIA and MA s.35B are concerned with disclosure to the world, in contrast to the individual data subject. The 'public interest' in disclosure under MA is distinct from the public interest (and P/GMC's legitimate interest) in transparency in the complaints procedure.

All in all GMC had carried out an appropriate balancing exercise with which the Court should not interfere.

Conclusions

67. In my judgment the GMC's balancing exercise, conscientious as it evidently was, fell into error and got the balance wrong.
68. First, in the absence of consent, it should have started with a presumption against disclosure (Durant). Although the decision letters took specific account of that decision, there is nothing to show that the exercise had this starting point.
69. Secondly, it gave no adequate weight to DB's status as a data subject or therefore the privacy right which he had in the Report. In my view, whilst containing the (sensitive) personal data of P, the Report's real focus is on DB's professional competence.
70. True it is that the GMC's consideration of DB's objections was complicated by BLM's initial submission that he was the sole data subject. Mr Graves' Memorandum of 31.10.14 correctly concluded that the Report involved the personal data of both P and DB and continued 'I am therefore required to balance the interests of both parties as per section 7(4) to 7(6)'. However, having done so, the Memorandum then referred to only two factors namely (i) the concern about the litigation purpose and (ii) transparency in the GMC decision-making process. The Memorandum shows no real consideration of DB's privacy right.
71. In this context I do not accept Mr Hopkins' submission that DB's 'reasonable expectation of privacy' was that the Report would be supplied if a request were made. Objectively understood, I consider that his reasonable expectation was that if a s.7 request were made the GMC would carry out a lawful balancing exercise which would include the fact that the Report contained inextricably mixed private information. That reasonable expectation was fortified by the fact of the GMC's practice in disclosing only a summary to the complainant in such circumstances.
72. BLM's response of 21.11.14 complicated matters by construing the Memorandum as if Mr Graves had concluded that the Report contained only the personal data of P. However it then made submissions as to DB's right of privacy, citing Article 8, the DPP and the decision in Mkolajova v. Slovakia (professional reputation).
73. Mr Graves' response of 13.2.15 duly referred to Article 8/the DPP and the need to balance the rights and interests of both parties. However the letter thereafter referred to 'the rights and freedoms of the data subject (i.e. [P]'s)', without reference to the rights and freedoms of the data subject DB. The letter then focussed on the concern that the Report should not be disclosed to one party alone.
74. The GMC's final response (10.6.15) stated that disclosure of the Report would not breach the DPP principles 'in terms of [DB]'s DPA rights'. However this assertion took the point no further.
75. In my judgment the result was that the GMC decision never gave any real weight to DB's privacy rights as a data subject; and instead focused on P's rights and the issue of transparency/equality.
76. Thirdly, the decision took no adequate account of DB's express refusal of consent. As I read the decision letters, the GMC treated the absence of consent as simply the background trigger for the need to carry out a balancing exercise and gave no specific weight to the explicit refusal of consent. By s.7(6)(d) the DPA draws a distinction between the absence of consent and an express refusal and specifically requires the data controller to have regard to the latter. I am not persuaded by Mr Hopkins' submission that the GMC did so by implication.
77. Fourthly, the decision took no adequate account of the fact (as the GMC had reasonably inferred from the coincidence of the request to the GMC and letter to DB on 11.9.14) that the purpose of the request was to use the Report and its information in the intended litigation against DB. The significance of this factor was two-fold. First, the information was not being sought for the purpose contemplated by the Directive, namely to protect P's privacy by ensuring the accuracy of the personal data (Durant). Secondly, in obtaining the document by this means DB would be deprived of the protection provided by the CPR 31 procedures; and in particular the restriction on the use of the document under CPR 31.22.
78. As to the latter, I take account of the absence of any evidence that P had disclosed the summary to a wider audience. However in circumstances where it appeared that the sole or dominant purpose was its use in litigation, I consider that this should have been a weighty factor in the scales. Putting it another way, the CPR 31 route provides both a less restrictive interference with DB's privacy right (South Lanarkshire) and the appropriate procedure for P's real purpose in seeking the document.
79. I consider Ms Proops' points on the comparison with FOIA/MA 1983 to be of limited weight. Those statutes are concerned with disclosure to the world, whereas DPA s.7 is concerned with disclosure to the requesting data subject. That said, the evidence that the GMC's practice is to require a NDA in respect of disclosure under s.35B provides further support for the weight that should be given to P's alternative remedy under CPR 31.
80. In my judgment these factors individually and cumulatively pointed towards refusal of the request; and the other factors relied on by GMC provide no sufficient counterweight.
81. As to transparency and equality of treatment, nothing in this judgment should be taken to question the general importance of those concepts. However I do not consider that it was a factor of any significant weight for the purpose of the balancing exercise in this case.
82. If the GMC had considered that the principles of transparency and equality required a supply of the full Report to a complainant (such as P) in circumstances where no further action was taken, its policy and practice would doubtless have reflected this. If so, the complainant's entitlement would not be dependent on making a request under s.7 DPA or otherwise. In the absence of such a policy or practice, I do not consider that the GMC is entitled to give any particular weight to this factor (and whether expressed as the legitimate interest of P or itself) in the balancing exercise between the parties. To do so is in effect to revise its policy by the side-wind of the DPA; and thereby to defeat the other data subject's reasonable expectation of privacy.
83. I accept that disclosure of the Report could provide P with a more detailed insight into the treatment he received, the experts' criticisms and the GMC's reason for taking no further action. However, and in the context of the GMC's practice of providing the complainant with a summary in such circumstances, I do not consider that this is a factor of weight against the practitioner's privacy right. Furthermore, P in fact made no application for a Rule 12 review of the GMC decision.
84. As to the submission that the disclosure of the report would not be damaging given what had already been provided, I consider that gives too little weight to DB's wish to preserve his right of privacy or to his assessment and concern about potential risk to his professional reputation.
85. I acknowledge that BLM's letters did not raise the arguments as to (i) DB's expectation of confidentiality (ii) the effect on DB's health or (iii) the possibility of wider dissemination of the Report by P. However, as to confidentiality, the broader right of privacy was squarely raised. As to health, the evidence is very limited and in my view takes matters no further. As to wider dissemination, I consider that this was a matter which the GMC should have had in mind in any event; particularly given its practice when making disclosures under the MA 1983, s.35B(2).
86. I remind myself that it is not for the Court to substitute its own judgment or to 'second guess' the GMC. However, having scrutinised the matter, I am persuaded that the GMC's balancing exercise did not adequately reflect the factors which I have identified and gave undue weight to the factors on which they relied. Accordingly my conclusion is that the decision was unlawful.
87. Counsel invited me to give guidance to the GMC for future mixed data cases of this particular type. In addition to the limited role of a first instance Judge in this respect, the difficulty in that invitation is demonstrated by the observations of the Court of Appeal in Durant that the Court should be wary of attempting to devise any principles of general application in respect of the balancing exercise (para.66). Each application has to be considered on its merits.
88. With those critical qualifications, I consider that in conducting the balancing exercise in mixed data cases of this type :

(1) it is essential to keep in mind that the exercise involves a balance between the respective privacy rights of data subjects;

(2) in the absence of consent, the rebuttable presumption or starting point is against disclosure (Durant). Furthermore the express refusal of consent is a specific factor to be taken into account;

(3) if it appears that the sole or dominant purpose is to obtain a document for the purpose of a claim against the other data subject, that is a weighty factor in favour of refusal, on the basis that the more appropriate forum is the Court procedure under CPR 31.

89. In all the circumstances my conclusion is that the claim must succeed. I invite submissions as to the appropriate form of order and other consequential relief.

Note 1   GMC Fitness to Practise Rules 2004, rule 12 : ‘Review of Decisions’    [Back]

Note 2   Member States may adopt legislative measures to restrict the scope of the obligations and rights provided for…when such a restriction constitutes a necessary measure to safeguard…(g) the protection of the data subject or of the rights and freedoms of others.’    [Back]

Note 3   ‘…the provisions appear to create a presumption or starting point that the information relating to that other…should not be disclosed without his consent. The presumption may, however, be rebutted if the data controller considers that it is reasonable ‘in all the circumstances’.’    [Back]

Note 4    Set out in paras. 38-39 above    [Back]