W, X, Y And Z, R (on the application of) v The Secretary of State for Health & Ors

Identifiable information showing that a patient received NHS treatment is inherently private and confidential. Whether disclosure infringes privacy nevertheless depends on all the circumstances, including whether the patient was informed that limited debt information might be shared for a stated immigration purpose.

Where no reasonable expectation of privacy exists as against the specified recipients, the common law right is not infringed. Even where it exists, disclosure may be justified by a proportionate balance between the modest, secure and limited disclosure and the public interest in recovering NHS charges.

General statutory information powers may coexist with a regulatory power concerning patient information. Non-statutory guidance operating within a statutory and data-protection framework may satisfy the requirement in article 8(2) that an interference be in accordance with law.

Four overseas visitors challenged departmental guidance under which NHS bodies provided limited non-clinical information about unpaid NHS debts of at least £1,000 to the Secretary of State for Health, who transmitted it to the Home Office. The information identified the patient, the NHS body, and the amount and date of the debt. It did not contain clinical details, although the identity of a specialist NHS body could sometimes indicate the nature of treatment.

They contended that the disclosures breached common law privacy and confidentiality, lacked statutory or common law authority, unlawfully fettered NHS bodies’ discretion, and violated article 8 of the Convention. Silber J dismissed the judicial review claim: [2014] EWHC 1532 (Admin). The Court of Appeal considered whether the information was private, whether the disclosure powers were available under the National Health Services Act 2006, and whether the scheme was in accordance with law for article 8 purposes.

1. Appeal dismissed. The information was inherently private because it disclosed that an identified person had sought treatment from an NHS body, and the identity of that body could reveal something about the person’s health. The judge had therefore erred in treating the information as non-private merely because it was less intrusive than detailed clinical material or might be passed to debt collectors.

2. Privacy was nevertheless assessed broadly and contextually. In the usual case, an overseas patient informed before treatment that limited debt information may be shared with the Department of Health and Home Office if the charge remains unpaid could not reasonably expect confidentiality as against those recipients. Special cases, including emergency treatment, unconsciousness, vulnerability or inability to understand English, might be different. In any event, disclosure was proportionate. It pursued the legitimate aims of debt recovery and effective immigration control, involved limited information, and was securely transmitted to a restricted group.

3. The principle of legality did not apply because the disclosure did not establish an unjustified infringement of privacy. Section 48 of the National Health Services Act 2006 authorised the Secretary of State to require NHS bodies to provide the information. Section 251 did not impliedly curtail that power. Section 251 regulates the processing of patient information by regulations, whereas section 48 directly permits the Secretary of State to require information needed for functions relating to the health service. The Guidance substantially stated the information required, and recovery of charges assisted the Secretary of State’s duties to promote and secure a comprehensive health service.

4. Section 2 authorised onward transmission to the Home Office because it facilitated the same statutory duties. The court also considered that such transmission was permissible at common law for an identifiably governmental purpose. NHS bodies had no residual discretion to withhold information on compassionate or inability-to-pay grounds once it was required under section 48; the alleged fetter of discretion therefore failed.

5. Assuming article 8 was engaged, the interference was in accordance with law. The non-statutory Guidance operated within a clear statutory framework, imposed defined conditions and limits on sharing, and was supplemented by safeguards under the Data Protection Act 1998. The absence of an NHS or departmental discretion to withhold data in individual cases did not make this tightly limited scheme arbitrary, particularly as immigration officers retained discretion when applying immigration sanctions.

• Court of Appeal (Civil Division) Dismissed the claimants’ appeal and upheld the lawfulness of the data-sharing guidance: [2015] EWCA Civ 1034.
• Administrative Court (High Court) Silber J dismissed the judicial review claim, holding that the disclosures were lawful and did not breach privacy rights: [2014] EWHC 1532 (Admin).