Roberts v Nottinghamshire Healthcare NHS Trust

Subject access under the Data Protection Act 1998 may be refused only under an applicable statutory exemption. For the health exemption, “likely” requires a very significant and weighty chance of serious harm, although the risk need not be more probable than not. The court reviews the data controller’s decision with anxious scrutiny, considering necessity and proportionality, but remains a reviewing court rather than the primary decision-maker. The data controller bears the civil burden of establishing the exemption. The court has no independent power to sanction non-disclosure outside the statutory scheme. Nor does it have power under section 15(2) to order disclosure of exempt material to the applicant’s lawyers while withholding it from the applicant.

The claimant, a patient detained at Rampton Hospital, sought access under section 7 of the Data Protection Act 1998 to a psychological report prepared by an employee of the defendant NHS trust. The trust declined disclosure, relying on concerns considered in a closed process. An earlier judgment had authorised the appointment of a special advocate, who inspected the report and other closed material.

The claimant sought an order under section 7(9), and alternatively sought disclosure to his solicitors on terms that the report would not be disclosed to him. The central issues were whether the trust had lawfully relied on an exemption and whether the court possessed power to order this proposed limited disclosure.

1. Statutory exemption. The trust had produced clear and compelling reasons, supported by cogent evidence, for refusing disclosure. Applying the health exemption, the relevant question was whether disclosure might very well create a risk of serious harm to the physical or mental health or condition of the claimant or another person. The risk need not be more probable than not. The inquiry was fact-sensitive and required consideration of the claimant’s personality, history and care regime.
2. Review under section 7(9). The court’s function was to review the data controller’s decision, not to decide the matter afresh. The court was required to apply anxious scrutiny, bearing in mind necessity and proportionality, and to determine whether the decision was flawed on public law grounds. The data controller bore the burden of proof to the civil standard.
3. Scope of the statutory scheme. The court had no independent discretion to sanction non-disclosure outside the Act and the exemptions made under it. The claimant’s reasons for wanting the report did not displace the applicable exemption. No injustice arose in the related tribunal proceedings because the trust did not intend to rely on the report and the claimant could present and challenge psychological evidence of his own.
4. Disclosure to solicitors. Section 15(2) permitted the court to require production of the data for its own inspection while deciding the application. It did not empower the court to order disclosure to the applicant’s legal representatives pending determination of the applicant’s entitlement. The Mental Health Review Tribunal Rules could not alter the construction of the Data Protection Act. In the absence of specific authorisation, lawyers generally had a duty to disclose relevant information to their client, although a client could in principle waive that right.
5. Disposition. The application for disclosure was refused. The court also declined to order disclosure to the claimant’s solicitors. The appointment of a special advocate was unusual and was not an automatic consequence of future applications under the Act.

The judgment records an earlier judgment in the same proceedings by Mr Justice Lloyd Jones, [2008] EWHC 1617, following which a special advocate was appointed. This was a first-instance application in the High Court.