DB v The General Medical Council

Where a subject access request concerns mixed personal data, the data controller must balance the respective privacy rights of the data subjects. In the absence of consent, the starting point is a rebuttable presumption against disclosure, and an express refusal of consent is a specific factor.

Where the dominant purpose is to obtain material for litigation against the other data subject, that purpose is a weighty factor against disclosure. The court’s disclosure procedures may provide a less restrictive and more appropriate route. Transparency and equality carry little weight where the controller has no policy or practice requiring disclosure. Review remains intensive, but the court must not substitute its own decision for that of the controller.

Dr DB, a general practitioner, sought declaratory relief preventing the General Medical Council from disclosing to his former patient, P, an expert report obtained during an investigation into P’s complaint about DB’s professional competence.

P’s request was treated as a subject access request under Data Protection Act 1998, section 7. The report contained inextricably mixed personal data concerning P’s health and treatment and DB’s professional competence and reputation. DB refused consent. The GMC decided that disclosure was reasonable after balancing the parties’ interests, having regard to litigation, transparency and equality.

The issue was whether that balancing exercise was lawful.

1. Claim allowed. The GMC’s decision to disclose the report was unlawful.
2. Under section 7(4) of the Data Protection Act 1998, the exercise concerns the competing privacy rights of the data subjects. In the absence of consent, the controller must begin with a rebuttable presumption or starting point against disclosure. Section 7(6)(d) separately requires regard to be had to an express refusal of consent.
3. The GMC gave inadequate weight to DB’s privacy rights, the report’s real focus on his professional competence, and his express refusal. It also failed adequately to account for the fact that the report was sought principally for contemplated litigation against DB. That purpose was a weighty factor in favour of refusal because obtaining the report through subject access would bypass the safeguards governing court disclosure, including CPR 31.22.
4. The court’s review of the balancing exercise is more intensive than traditional Wednesbury review because fundamental privacy and data-protection rights are engaged. The court must scrutinise the decision anxiously, but must not substitute its own assessment for that of the data controller.
5. Transparency and equality are generally important, but carried no significant weight here. The GMC had no policy or practice requiring disclosure of the full report when a complaint was closed with no further action. Disclosure could not properly be used to revise that policy by means of the subject access regime.
6. These factors, individually and cumulatively, pointed towards refusal. The court declined to devise general rules beyond the identified guidance because each mixed-data request must be decided on its own merits.