Employment Law News
Data subject access requests and third party information
Documents containing the personal information of more than one person should not automatically be disclosed on submission of a subject access request. A balancing exercise must be done to determine whether disclosure is appropriate in the circumstances.
P was diagnosed with bladder cancer in 2013 and alleged to the General Medical Council that the incompetence of his general practitioner, DB, delayed the diagnosis by a year. The GMC obtained an expert report into DB’s work as part of the investigation into P’s complaint. The GMC sent a one-page summary of the report to P, after which P put in a data subject access request for the full version. DB refused to consent to disclosure of the full report, though the GMC was minded to disclose it to P in keeping with the transparency of the investigation process. DB brought proceedings against the GMC to prevent that from happening.
The High Court held that the report should not be disclosed to P. Since the report contained personal data of both P and DB, they had competing privacy rights. As DB had withheld his consent to disclosure, the starting position ought to have been that the report would not be shared with P. DB’s right to privacy also included protection of his professional reputation and he was entitled to expect the GMC to uphold it.
Another key factor in the High Court’s determination was that the purpose of P’s request was the intended clinical negligence litigation against DB. This was at odds with the aim of the data protection regime, which is to check the accuracy of data held about the person making the request.
As with most cases involving data protection, this case stresses the need for companies to weigh up parties’ competing interests. Companies should be aware that, though data subjects have the right to request disclosure of their personal information, it does not automatically warrant disclosure of all materials. As the GMC did in this case, it is best to ask for the data subject’s permission before disclosing information. On the other hand, this case tells us to take the withholding of that consent seriously, which the GMC failed to do.
Dr DB v General Medical Council EWHC 2331
