AB, R (On the Application Of) v Northumbria Healthcare NHS Foundation Trust & Anor (Rev 1)

The claimant sought a mandatory order requiring two NHS trusts to erase an allegedly inaccurate referral in the medical records of her 17 year old son (V). The central legal issues were whether permission to apply for judicial review should be granted, whether alternative remedies had to be exhausted, and whether the General Data Protection Regulation (GDPR) and the Data Protection Act 2018 required erasure rather than correction/annotation of the records. The court concluded that an adequate alternative remedy existed in complaints and statutory processes under the Data Protection Act (including the Information Commissioner and the route under sections 167–168 of the Data Protection Act 2018 and the possibility of an Equality Act remedy) and therefore permission to proceed with judicial review should not be granted. The judge also found that, on the merits, rectification had been effected and retention was lawful on health grounds under the GDPR (articles 6 and 9) and article 17(3) would in any event exclude a right of erasure; consent was not the legal basis for retention. Other issues (standing, delay) were considered but were not decisive. The renewed application for permission was refused and the application to adduce further evidence was dismissed.

This is a renewed oral application for permission to apply for judicial review brought by the mother of a 17 year old with diagnosed disabilities. The claimant sought a mandatory order directing two NHS trusts to erase a written referral (the "First Referral") from the son’s medical records on the grounds that it contained inaccurate and damaging information concerning his sexual behaviour. The claim raised data protection issues under the GDPR and the Data Protection Act 2018, alleged breaches of the Equality Act 2010 and, to a limited extent, Convention rights.

Procedural posture: Permission had been refused on the papers by HH Judge Saffman on 30 April 2020; this was a renewed oral application before His Honour Judge Davis‑White QC (sitting as a High Court judge). The claimant appeared in person; the trusts were represented by counsel. The judge also made a reporting restriction order under section 39 of the Children and Young Persons Act 1933.

Factual background:

• The First Referral (20 August 2018) to a forensic Child and Adolescent Mental Health Service contained two inaccuracies: statements about a baby being naked and overstated frequency of masturbation. After the claimant raised concerns, the first defendant (Northumbria Trust) investigated, apologised and sent corrected information to the second defendant (CNTW Trust) by letter dated 19 December 2018, requesting deletion of the original referral from CNTW systems and uploading corrected material. CNTW updated progress notes in January 2019 and later added a corrective alert to the electronic record.
• A later (Second) referral and further contacts arose following disclosure to V of the existence/inaccuracies in the First Referral and a subsequent incident involving V; the context made retention of the precise original referral relevant to understanding later events.

Issues framed:

1. Whether the claimant had standing to bring the claim on behalf of her son;
2. Whether the claim was brought promptly and within the three month judicial review time limit;
3. Whether there was an adequate alternative remedy (notably complaint to the Information Commissioner and statutory routes under the Data Protection Act and Equality Act) which ought to have been exhausted;
4. On the merits, whether GDPR/article 17 required erasure rather than rectification/annotation and whether processing was lawful on health grounds; and
5. Whether additional evidence (transcripts of calls to a GP practice) should be admitted.

Court's reasoning and conclusions:

• The judge noted serious doubts about the claimant's standing but did not decide that point because the question of standing should ordinarily be considered at a substantive hearing and the claimant had invited the court to join the son; no litigation friend had been appointed for him.
• Delay was examined. The judge accepted that for the purposes of running of time it is communication of the decision (or the claimant’s reasonable ability to discover it) that starts the clock, and he could not determine at this stage that the claim was out of time. He therefore did not refuse permission on grounds of delay.
• The judge found that complaint to the Information Commissioner under section 165 was, on the facts, an adequate alternative remedy which should have been pursued and was in fact pursued and exhausted. He also accepted statutory routes under the Data Protection Act (sections 167–168) and the Equality Act (section 114) as available alternative remedies. Because adequate alternatives existed and were or could be pursued first, permission for judicial review ought not to be granted.
• On the merits, the judge agreed with the trusts and the ICO's approach: rectification had been put in place, and retention of the referral for clinical reasons and to show the trigger for later events was lawful. The trusts could lawfully rely on health bases under articles 6 and 9 GDPR and article 17(3) would exclude any right to erasure that might otherwise have arisen. Consent was not relied upon for the lawfulness of retention; therefore the claimant’s submission that withdrawal of consent required deletion was incorrect. The alleged Equality Act and Convention rights points did not add force to the claim.
• The application to adduce further evidence (GP call transcripts) was refused as not materially advancing the issues before the court.

The renewed application for permission was refused both because an adequate alternative remedy existed and, in any event, because the claim had no real prospects of success on its merits.

Permission to apply for judicial review is refused. The court held that there was an adequate alternative remedy (notably complaint to the Information Commissioner and statutory routes under the Data Protection Act 2018 and the Equality Act 2010) which should have been pursued and exhausted, and that, on the merits, rectification had been effected and retention of the referral was lawful on health grounds under the GDPR and the Data Protection Act 2018 so erasure was not required. The application to adduce further evidence was dismissed.