Privacy of a doctor under GMC investigation clashes with that of his patient

24 September 2016 by David Hart KC

Dr DB v. General Medical Council [2016] EWHC 2331 (QB), 23 September 2016, Soole J – read judgment

An interesting three-way privacy fight between a GP, a patient who had complained about his treatment by the GP, and the GMC who had investigated that complaint. The prize in that fight was a copy of a medical report obtained by the GMC from an independent expert, which had concluded that the GP’s care had fallen below “but not seriously below” the expected standard.

The patient had wanted a copy of the report; all he had seen so far was a one-page summary. His motive was to investigate a possible claim for clinical negligence, arising out of the delayed diagnosis of his bladder cancer. The GP refused consent. 

The GMC then concluded it should disclose the report to the patient. And the GP brought these proceedings to stop disclosure.

The law

The overriding structure of this dispute was derived from data protection law.  And the problem arose because both patient and GP had personal data inextricably mixed in the disputed report. The patient sought the report under freedom of information legislation on the basis that it contained his own personal data. s.7(4)-(6) of the Data Protection Act 1998 sets out a balancing exercise in such mixed data cases, with the data controller (here the GMC) obliged to have regard to its duty of confidentiality to the other party (here the GP), and to any express refusal of  consent by the other party. Case law (Durant v. FSA) said that there was a rebuttable presumption against disclosure in the absence of consent.

The GMC had been in the course of  investigating the GP’s Fitness To Practice (FTP) as part of its regulatory functions. As a result of the report, it concluded that no further action should be taken against the GP.

The contrary cases

The GMC decided in favour of disclosure, relying on (at [27] of the judgment) the sensitivity of the patient’s medical records, the independence of the reporting doctor (hence, it was said, it should be disclosed to both parties), the GMC’s legitimate interest in fairness and transparency, the patient’s legitimate interest in seeing the document which brought his complaint to an end, the minimal risk to the GP’s reputation, and the lack of risk that the patient might misuse the GP’s personal data.

The GP in response ([29]) pointed to his 25 years of unblemished practice, the possibility of online misuse of the report, the lack of his own comment in response to the conclusions, and his expectation that once the GMC had decided not to bring FTP proceedings the report would be kept confidential.

The judge pointed out at [34] that the court’s role, whilst a review one of the GMC’s decision, was more intensive than this traditional Wednesbury one (which takes account of the high degree of deference conventionally accorded by the courts to the discretion of the decision-maker whose decision is under challenge in judicial review proceedings); the case involved the weighing of fundamental rights and therefore, should be subject to “anxious scrutiny”.

The judge’s conclusion

The judge robustly concluded at that the GMC’s balancing exercise fell into error and got the balance wrong.

Notably, it did not start with the presumption against disclosure. It gave no adequate weight to the GP’s status as a data subject or the privacy right which he had in the Report. Whilst containing the (sensitive) personal data of patient, the report’s real focus is on the GP’s professional competence. One’s professional reputation was within the scope of Article 8: in Mkolajova v. Slovakia

Nor did the decision take adequate account of DB’s express refusal of consent.

The judge thought that the potential significance of the use of the report in litigation was two-fold. First, the information was not being sought for the purpose contemplated by the Directive, namely to protect P’s privacy by ensuring the accuracy of the personal data. Secondly, in obtaining the document by this route meant that the GP would be deprived of the protection provided by the ordinary civil procedure rules for disclosure. That route provides both a less restrictive interference with the GP’s privacy right and the appropriate procedure for the GP’s real purpose in seeking the document.

The GMC attached considerable importance to transparency and equality of treatment. Whilst of general importance, they were not factors of significant weight for the purpose of the balancing exercise required by statute. Insufficient weight was given to the GP’s wish to preserve his right of privacy or to his assessment and concern about potential risk to his professional reputation.

Hence the decision was unlawful.

The judge was invited to give some guidelines for future cases. He was reluctant to go too far, but at [88] stated the following

(1) it is essential to keep in mind that the exercise involves a balance between the respective privacy rights of data subjects;

(2) in the absence of consent, the rebuttable presumption or starting point is against disclosure (Durant). Furthermore the express refusal of consent is a specific factor to be taken into account;

(3) if it appears that the sole or dominant purpose is to obtain a document for the purpose of a claim against the other data subject, that is a weighty factor in favour of refusal, on the basis that the more appropriate forum is the Court procedure under CPR 31.

Conclusion

It is interesting that such a dispute between patient, GP and GMC had not previously got to court. The strong steer from the judge is that, even if the GMC had worded its response rather more closely following the DPA, it could not lawfully have ruled in favour of the patient. The key, and unsurprising, finding was that the report was really all about the GP’s personal data, rather than the patient’s. That, coupled with the presumption of non-disclosure in the absence of consent, essentially foreclosed the patient’s request.