Employers cannot necessarily refuse disclosure because it breaches data privacy of others

A SIXTH ANNIVERSARY MESSAGE FROM GARETH BRAHAMS, MANAGING PARTNER OF BDBF

 

Individuals are entitled to a right of access to their personal data. In a situation where that request cannot be complied with without disclosing information relating to another identifiable individual – where it contains ‘mixed data’ – employers  often refuse to comply with the request, unless that other individual has consented to disclosure of their personal information.

The case was concerned with disclosure of an independent expert’s report. The report contained personal data relating to both the patient, P, and his doctor, Dr B. The patient who was the subject of the report sought full disclosure from the General Medical Council (GMC), although the doctor did not consent to the report’s disclosure. On balance, the GMC took the decision that the report contained P’s personal data and should therefore be disclosed to him. The doctor took the matter to the High Court.

The Court of Appeal ordered disclosure of the report. There was no sound basis upon which to favour the rights of Dr B. Ultimately, the data access rights of the patient trumped those of the doctor.

B v General Medical Council [2018] EWCA Civ 1497