Subject access requests for mixed personal data
DR B v The General Medical Council  EWCA CIV 4197
In proceedings before the High Court the Registrant, Dr B, had successfully challenged the General Medical Council’s (GMC) decision to disclose to P, the patient complainant, an expert report in respect of the care which Dr B had provided to the P who sought the report through a subject access request (SAR).
Prior to the initial High Court proceedings the GMC had disclosed a summary of the report to P as part of the Case Examiners’ decision to conclude the GMC’s investigation with no further action.
In a 2:1 decision two recent Supreme Court appointees, Arden LJ and Sales LJ allowed the GMC’s appeal with Irwin J dissenting.
It was accepted that the data which had been the subject of the SAR was mixed personal data, as it contained the personal data of Dr B and P.
No presumption against disclosure of mixed personal data
Departing from Auld LJ in Durant, the majority held that any presumption against disclosure in mixed data cases was ‘of the weak, tie breaker type … not a significant or substantive presumption to be applied at the outset’. Sales LJ described its role as being limited to those cases where following the conduct of the balancing exercise there was ‘perfect equilibrium with nothing to choose between [the arguments for and against disclosure].’
The requester’s privacy interests in disclosure
Sales LJ identified a number of legitimate interests which the P had from a Data Protection perspective observing:
‘A person who makes a complaint about a doctor with respect to the medical treatment he has received has a legitimate interest in understanding, and being in a position to check, the basis in respect of his personal data for a decision by the GMC not to pursue the allegation by instigating a disciplinary procedure against the doctor. The P also has a legitimate interest in receiving information which will enable him to see whether there may be grounds for making a request for a reconsideration pursuant to Rule 12 [of the Fitness to Practise Rules]. These are interests which are within the scope of the type of interests which the subject access rights under Article 12 of the Directive and Section 7 of the DPA are intended to safeguard.’
On Irwin LJ’s analysis the P had already received sufficient material to allow him to challenge or correct any inaccuracy in the personal data on which the expert report had been obtained. He lacked only the detailed reasons for the expert’s conclusions. Conversely, Sales LJ viewed provision of the report as necessary for P to ascertain whether there was any inaccuracy in the information set out about him ‘which might have affected the views expressed in the Report.’
Motivation and subject access requests
The Court confirmed ‘the general position … that the rights of subject access to personal data under Article 12 of the Directive and Section 7 of the DPA are not dependent on appropriate motivation on the part of the requester.’ However, both Sales LJ and Arden LJ agreed that the requester’s motivation will be a relevant consideration in the context of a mixed data case in order to ascertain the extent ‘to which the interests on either side … are of a kind which are protected by the legislation … and may be prejudiced by a decision one way or the other.’
Arden LJ explained that ‘a litigation motive is not irrelevant … but nor yet is it a disqualifying factor’. Illustrating the potential role which a litigation motive may play, she gave the example of a case where an individual requesting mixed data is a vexatious litigant or wishes to bring further litigation of a kind that has previously been held to be an abuse of the Court.
The role of non-disclosure agreements
In conducting the balancing exercise the controller is entitled to take account of binding undertakings given by the requesting data subject in respect of the future use or integrity of the data to be disclosed. Arden LJ stressed that any such undertaking would have to be given in a form that it was enforceable by the other data subject before the controller could properly rely on it. The provision of such an undertaking did not absolve the data controller of the need to undertake the required balancing exercise.
The standard of review
In the context of a challenge to a controller’s decision to either disclose or withhold mixed personal data in the context of a subject access request, the Court’s role is limited to one of review and it is not for the Court to substitute its own assessment of the weight to be given to the competing interests. As Sales LJ explained:
‘The question for the Court is … was it reasonable in all the circumstances for the data controller to refuse the request or to decide to comply with the request. If the data controller did not make a reasonable assessment, in either case the Court has a discretion to make the relevant assessment itself and then order the data controller to act on that assessment or to quash the data controller’s existing assessment and remit the matter for fresh determination by the data controller. If the Court decides to make the relevant assessment itself, it has to seek to balance the competing rights and interests as primary decision maker.’
Sales LJ noted that ‘the legislature contemplated that individual data controllers should be afforded a wide margin of assessment in making the evaluative judgments required in balancing the privacy rights and other interests in issue under Section 7(4).’
In identifying the relevant factors that need to be considered, the objections raised by a data subject resisting disclosure were relevant. However, Sales LJ emphasised that it was not incumbent on the controller to cast about for alternative arguments against disclosure.
The doctor’s interest in being protected from litigation
Irwin LJ dismissed the GMC’s appeal regarding the potential for litigation against the joint data subject as being a weighty factor to weigh in the balance against disclosure observing:
‘Very often, as here, the professional will have no option but to be made the subject of such a report. This has potential implications beyond medicine and the other health professions. Financial professionals might easily be faced with the same problem. If I am wrong, then this route will be an obvious way to circumvent the requirements of the CPR, and it is easy to conceive how such an approach may lead to professional complaints which would not otherwise be made, and which are made in fact only to achieve the contingent benefit of free access to a professional review, where the potential professional defendant cannot raise the obvious objections.’
Whilst Sales LJ acknowledged that Dr B’s desire to be protected from litigation was not ‘wholly irrelevant’ he nonetheless described it as ‘peripheral to the main focus of the balancing exercise, which is concerned with weighing the privacy interests of the requester and objector.’
Although this case was decided under the Data Protection Act 1998 it remains relevant to the application of the updated regime under the GDPR and Data Protection Act 2018.
It is unfortunate that the majority did not directly address the contention that the withheld material was not required for P to challenge the accuracy and/or completeness of the personal data relied upon by the expert. The analysis of that question is highly relevant to the weight to be attached to P’s data protection interests in disclosure. Neither did the majority address Soole J’s assessment that the withheld information related primarily to Dr B and not P, Sales LJ simply noting that ‘it is common ground that the entirety of the expert report … should be regarded as comprising the mixed personal data of Dr B and P.’
As Sales LJ noted, the outcome of the balancing exercise required in dealing with SARs in mixed personal data cases ‘will inevitably depend on the particular facts and context’. It remains open to professionals to argue, as a matter of fact, that the privacy rights of the requester in an expert’s opinion on their standard of care are comparatively weak. However, they should not expect their desire to be protected from litigation to be given significant weight.
For more information or guidance, please contact:
T. 020 7227 7418
This briefing is for guidance purposes only. RadcliffesLeBrasseur accepts no responsibility or liability whatsoever for any action taken or not taken in relation to this note and recommends that appropriate legal advice be taken having regard to a client's own particular circumstances.