R v Department of Health, Ex parte Source Informatics Ltd

The equitable duty of confidence protects the privacy of a person who supplies confidential medical information. It does not give that person a proprietary right to control every subsequent use of the information.

A pharmacist therefore commits no breach by converting prescription information into a form from which the patient cannot be identified and supplying that information to another person. The decisive inquiry is whether the patient’s privacy is invaded or imperilled and whether the proposed use would trouble the conscience of a reasonable confidant.

Objections to the commercial or public consequences of an anonymised-data scheme cannot enlarge the law of confidence. Any desired restriction must be imposed through appropriate regulation.

Source Informatics Ltd proposed a scheme under which doctors and pharmacists would supply anonymised prescription information. It would aggregate information about individual doctors’ prescribing habits and sell the resulting database to pharmaceutical companies. Patients’ identities were to be removed before information reached Source.

The Department of Health issued guidance stating that anonymisation did not remove the duty of confidence owed to patients. Latham J dismissed Source’s application for judicial review, holding that the scheme would involve a breach unless patients consented: [1999] 4 All ER 185.

Source appealed. The central issue was whether a pharmacist who had dispensed the prescribed medicine would breach confidence by using the prescription to supply information from which the patient could not be identified. The court proceeded on the assumption that anonymity could be guaranteed.

1. Appeal allowed unanimously. Simon Brown LJ delivered the judgment. Aldous LJ and Schiemann LJ agreed. The Department’s view that the proposed scheme necessarily breached patient confidence was legally erroneous.

2. The equitable obligation of confidence rests on conscience and good faith. Its scope depends on whether the confidence reposed in the recipient has been abused through unconscientious use. The practical inquiry was whether a reasonable pharmacist would consider participation in the scheme a betrayal of patients’ confidence.

3. For personal medical confidences, the protected interest was the patient’s privacy. A patient had no proprietary claim to the prescription or its contents and no general right to control the information’s use. Where identifying material was removed and privacy was neither invaded nor put at risk, supplying the remaining information did not breach confidence. Consent and proof of a countervailing public interest were therefore unnecessary.

4. X v Y [1988] 2 All ER 648 did not determine the present issue. There, confidential information had initially reached the newspaper defendants through a flagrant breach. The decision showed only that anonymised publication does not invariably defeat a confidence claim. It did not establish that a person who lawfully receives information breaches confidence by anonymising it.

5. The court did not decide definitively the effect of Directive 95/46/EC or the impending Data Protection Act 1998. Simon Brown LJ nevertheless considered that recital 26, common sense and justice strongly supported the view that rendering data genuinely anonymous fell outside the Directive’s protection of personal data.

6. Whether targeted marketing increased the cost of NHS medicines was irrelevant to the existence of a breach. If the Department regarded schemes of this kind as contrary to the public interest, it had to obtain regulatory powers to control them. The law of confidence could not be distorted for that purpose. The court allowed the appeal and directed that its judgments stand as the declaration.

1. Court of Appeal: Allowed Source Informatics Ltd’s appeal unanimously and displaced the conclusion that the proposed anonymised-data scheme would breach confidence.
2. High Court: Latham J dismissed the application for judicial review, holding that the proposal would constitute a breach of confidence without patient consent: [1999] 4 All ER 185.