Data Protection and Regulation
In DB v GMC [2016] EWHC 2331 (QB) the High Court addresses the problem of litigants attempting to use the Data Protection Act to obtain documentation for civil actions.
It is frequently the case that regulatory proceedings are used as an adjunct to civil proceedings – whether by using the threat of a referral to facilitate a settlement or by seeking to use the regulatory investigation to establish liability.
In this instance Dr DB faced a referral for failing to diagnose a patient’s (P) bladder cancer. The GMC commissioned an expert report. This concluded that DB’s actions fell below the proper standards in a number of respects but not “seriously below”. On that basis the GMC did not pursue the case and invited the Case Examiners to conclude the case with no further action. A letter was sent to P summarising the findings of the report and this proposal. The Case Examiners acceded to this recommendation.
Subsequently P requested a copy of the report from the GMC under s. 7 Data Protection Act 1998 (DPA). Dr DB expressly refused to consent to its disclosure. Nonetheless, the GMC agreed P was entitled to see it. In reaching this conclusion, the GMC noted that the report was being sought in order to pursue a claim against the doctor but doubted if it would assist P given that it was “largely supportive” of DB’s actions. Furthermore, taking account of the:
“… transparency of our decision making process, I feel there is a strong case to justify providing [P] with a document which played a key role in the GMC’s decision to close his complaint at an early stage. There is certainly the potential for [P] having considered the comment of the expert, to seek a Rule 12 review with the GMC. His opportunity for doing this without sight of this key piece of evidence will undoubtedly be hampered.”
Rule 12 referred to the right to ask for a Case Examiners’ decision to be reconsidered.
DB brought a claim under CPR Part 8, seeking a declaration that this disclosure would be unlawful. The court agreed. Whilst the GMC had recognised it was obliged under the DPA to conduct a balancing exercise between P and DB’s rights, it failed to pay sufficient regard to a number of key factors:
In the absence of a data subject giving consent the presumption was against disclosure. The GMC did not appear to appreciate this was the starting point.
The decision failed to give adequate weight to the fact DB was himself a data subject, and not just P. Whilst the report contained sensitive personal data relating to P, the report’s real focus was on DB’s professional competence. The decision really only focused on two factors: (i) the concern about the litigation purpose and (ii) transparency in the GMC decision-making process. It showed no real consideration of DB’s privacy right.
The decision took no adequate account of DB’s express refusal of consent. s.7(6)(d) of the DPA draws a distinction between the absence of consent and an express refusal and specifically requires the data controller to have regard to the latter.
The decision took no adequate account of the fact that the purpose of the request was to use the report in litigation against DB. Therefore, the information was not being sought for the purpose behind by the Act, namely to protect P’s privacy by ensuring the accuracy of the personal data. Furthermore, by using this avenue to obtain the report, DB would be deprived of the protection provided by the appropriate disclosure procedures under CPR 31 procedures, in particular the restriction on the use of such documents under CPR 31.22. The court reiterated:
“in circumstances where it appeared that the sole or dominant purpose was its use in litigation, I consider that this should have been a weighty factor in the scales. Putting it another way, the CPR 31 route provides both a less restrictive interference with DB’s privacy right… and the appropriate procedure for P’s real purpose in seeking the document.”
The judge rejected the GMC’s reliance on the principles of transparency and equality. If these considerations did justify disclosure of such reports where a case was dropped, its policies would have reflected this. To allow reliance on this policy consideration now would be “in effect to revise its policy by the side-wind of the DPA; and thereby to defeat the other data subject’s reasonable expectation of privacy.”
Whilst this disclosure could provide P with a more detailed insight into the treatment he received, the experts’ criticisms and the GMC’s reason for taking no action, in the context of the GMC’s practice of providing a summary of the report, this was not a significant factor to weigh against the practitioner’s privacy right. Furthermore, P in fact made no application for a Rule 12 review of the GMC decision.
The court provided limited further guidance to regulators, and indeed other data controllers, when considering disclosure of mixed data cases:
“(1) it is essential to keep in mind that the exercise involves a balance between the respective privacy rights of data subjects;
(2) in the absence of consent, the rebuttable presumption or starting point is against disclosure… Furthermore the express refusal of consent is a specific factor to be taken into account;
(3) if it appears that the sole or dominant purpose is to obtain a document for the purpose of a claim against the other data subject, that is a weighty factor in favour of refusal, on the basis that the more appropriate forum is the Court procedure under CPR 31.”
It is to be hoped that regulators will be more robust in future when dealing with such applications.
Categories: Articles
