Dr Sarah Myhill v The Information Commissioner & Anor

A refusal to confirm or deny whether information is held may be justified under Freedom of Information Act 2000, section 40(5B)(a)(i), where confirmation or denial would disclose personal data and would contravene the data-protection principles.

Under Article 6(1)(f) GDPR, the requester’s legitimate interests must be balanced against the data subjects’ privacy rights. A public authority may give substantial weight to doctors’ reasonable expectation that an unsubstantiated complaint will remain confidential, and to the distress and reputational harm which disclosure to the world at large may cause.

The balance is assessed at the date of the public authority’s refusal. Later developments cannot establish an error of law in the earlier decision; a requester relying on changed circumstances should make a fresh request.

Dr Sarah Myhill requested confirmation whether the General Medical Council held an evidence base for its decision not to investigate her fitness-to-practise complaint concerning identifiable doctors. The GMC refused to confirm or deny that it held the information, relying on section 40(5B)(a)(i) of the Freedom of Information Act 2000.

The Information Commissioner upheld that response. The First-tier Tribunal, by a majority, dismissed Dr Myhill’s appeal. It held that confirmation or denial would reveal third-party personal data and that the doctors’ privacy rights outweighed the legitimate interests advanced for disclosure. A minority member reached the opposite conclusion on the final balancing exercise.

Dr Myhill appealed to the Upper Tribunal, alleging that the earlier decision notice required disclosure, that the minority view showed error, that later NICE guidance changed the position, and that the respondents had acted dishonestly.

1. Appeal dismissed. The First-tier Tribunal made adequate findings and gave adequate reasons. Its majority decision involved no error of law.
2. The earlier decision notice required the GMC to provide a FOIA-compliant response. It did not require the GMC to disclose the requested information. The GMC therefore complied with that notice when it issued its refusal to confirm or deny whether the information was held.
3. The existence of a dissent in the First-tier Tribunal did not itself show an error of law in the majority decision. Dr Myhill had not identified a legal error in the majority’s balancing exercise.
4. The Upper Tribunal also accepted, if it had been necessary to decide the point, that prior professional or parliamentary discussion did not displace the doctors’ reasonable expectation of privacy. Reference to one doctor in a debate was insufficient on these facts to alter the balance in favour of disclosure.
5. The relevant Article 6(1)(f) GDPR balance fell to be assessed when the GMC refused the request on 24 October 2019. The later NICE guidance did not then exist and could not impeach the legality of that refusal or the First-tier Tribunal’s decision. If circumstances had materially changed, the appropriate course was a fresh information request.
6. The Tribunal was not required, and should not have been invited, to determine disputed matters of medical expertise. There was no evidence supporting allegations of intellectual dishonesty or misfeasance by the Information Commissioner or the GMC.

• Upper Tribunal (Administrative Appeals Chamber): dismissed Dr Myhill’s appeal and held that the First-tier Tribunal’s decision involved no error of law: [2022] UKUT 207 (AAC).
• First-tier Tribunal (Information Rights): by a majority, dismissed the appeal from the Information Commissioner’s decision notice on 6 April 2021. It held that the GMC could rely on section 40(5B)(a)(i) of the Freedom of Information Act 2000 to neither confirm nor deny that it held the requested information.