DB v GMC  EWHC 2331 (Admin)
High Level Summary
It amounted to a breach of the Data Protection Act 1998 for the GMC to disclose an expert report to a patient complainant in the circumstances. The High Court provided some tentative guidance as to the factors to apply when considering whether disclosure of such reports is justified.
A patient ("P") made a complaint to the GMC that his GP ("DB") had treated him incompetently, with a consequence that there was a delay of a year in diagnosing him with bladder cancer. As part of its investigation, the GMC sought an expert report. The report was critical of the doctor in a number of respects, concluding that his conduct fell below, but not far below, the expected standard. A copy of the report was sent to DB, with a letter informing him that the case was being sent to the GMC's Case Examiners for a decision. In due course, the Case Examiners decided to conclude the matter with 'no further action'.
P made a request for the report under the Freedom of Information Act 2000. The GMC decided to deal with the request as a subject access request under the Data Protection Act 1998 ("DPA"). DB did not consent to the disclosure of the report to P. In particular, it was submitted by his solicitors on his behalf that the DPA request was being used as a vehicle for pre-action disclosure with a view to litigation of further complaint, which is contrary to the principles in Durant v FSA  EWCA Civ 1747.
An Information Access Manager at the GMC decided that on balance it was appropriate to disclose the report in its entirety. Particular reliance was placed on the fact that, in his view, the report would be unlikely to assist P in any subsequent litigation; that the report played a key role in the GMC's decision to take no further action; and that, having considered with report, there is potential for P to seek a rule 12 review of that decision.
DB brought proceedings for declaratory relief under Part 8 of the CPR that the report not be disclosed to P.
Soole J considered that the balancing exercise performed by the GMC and the decision to disclose the report to P was wrong, even though it was exercised conscientiously.
The Court reminded itself that the Court's role in examining the decision is more intensive than the Wednesbury unreasonableness test.
In the Court's view, in the absence of consent to disclose such a document, the GMC should have started with a presumption against disclosure. The GMC did not do so.
Furthermore, the GMC did not give adequate weight to DB's status as a data subject and, therefore, the privacy right which he had in the report. Although the report contained the sensitive personal data of P, its real focus is on DB's professional competence. Undue focus was placed on P's rights and the issue of transparency/equality.
In addition, no adequate account was given to DB's express refusal of consent for disclosure. The DPA draws a distinction between the absence of consent and its express refusal, and requires the data controller to have regard to that.
Finally, the GMC failed to take adequate account of the fact that the purpose of the request was to use the report and its information in the intended litigation against DB. In doing so, the information is not being sought for the purpose contemplated by the EU Directive that led to the DPA, namely to protect P's privacy by ensuring the accuracy of the personal data.
Both parties invited the Court to lay down guidance for future 'mixed data' cases. Whilst qualifying the guidance given with the observation that in Durant the Court of appeal stated that it is hard to devise any principles of general application in respect of the balancing exercise, Soole J stated:
- It is essential to keep in mind that the exercise involves a balance between the respective privacy rights of data subjects;
- In the absence of consent, the rebuttable presumption or starting point is against disclosure. Furthermore the express refusal of consent is a specific factor to be taken into account;
- If it appears that the sole or dominant purpose is to obtain a document for the purpose of a claim against the other data subject, that is a weighty factor in favour of refusal on the basis that the more appropriate forum is the Court procedure under CPR 31.”