Privacy of a doctor under GMC investigation clashes with that of his patient

24 September 2016 by

privacy-policy-fullDr DB v. General Medical Council [2016] EWHC 2331 (QB), 23 September 2016, Soole J – read judgment

An interesting three-way privacy fight between a GP, a patient who had complained about his treatment by the GP, and the GMC who had investigated that complaint. The prize in that fight was a copy of a medical report obtained by the GMC from an independent expert, which had concluded that the GP’s care had fallen below “but not seriously below” the expected standard.

The patient had wanted a copy of the report; all he had seen so far was a one-page summary. His motive was to investigate a possible claim for clinical negligence, arising out of the delayed diagnosis of his bladder cancer. The GP refused consent. 

The GMC then concluded it should disclose the report to the patient. And the GP brought these proceedings to stop disclosure.

The law

The overriding structure of this dispute was derived from data protection law.  And the problem arose because both patient and GP had personal data inextricably mixed in the disputed report. The patient sought the report under freedom of information legislation on the basis that it contained his own personal data. s.7(4)-(6) of the Data Protection Act 1998 sets out a balancing exercise in such mixed data cases, with the data controller (here the GMC) obliged to have regard to its duty of confidentiality to the other party (here the GP), and to any express refusal of  consent by the other party. Case law (Durant v. FSAsaid that there was a rebuttable presumption against disclosure in the absence of consent.

The GMC had been in the course of  investigating the GP’s Fitness To Practice (FTP) as part of its regulatory functions. As a result of the report, it concluded that no further action should be taken against the GP.

The contrary cases

The GMC decided in favour of disclosure, relying on (at [27] of the judgment) the sensitivity of the patient’s medical records, the independence of the reporting doctor (hence, it was said, it should be disclosed to both parties), the GMC’s legitimate interest in fairness and transparency, the patient’s legitimate interest in seeing the document which brought his complaint to an end, the minimal risk to the GP’s reputation, and the lack of risk that the patient might misuse the GP’s personal data.

The GP in response ([29]) pointed to his 25 years of unblemished practice, the possibility of online misuse of the report, the lack of his own comment in response to the conclusions, and his expectation that once the GMC had decided not to bring FTP proceedings the report would be kept confidential.

The judge pointed out at [34] that the court’s role, whilst a review one of the GMC’s decision, was more intensive than this traditional Wednesbury one (which takes account of the high degree of deference conventionally accorded by the courts to the discretion of the decision-maker whose decision is under challenge in judicial review proceedings); the case involved the weighing of fundamental rights and therefore, should be subject to “anxious scrutiny”.

The judge’s conclusion

The judge robustly concluded at that the GMC’s balancing exercise fell into error and got the balance wrong.

Notably, it did not start with the presumption against disclosure. It gave no adequate weight to the GP’s status as a data subject or the privacy right which he had in the Report. Whilst containing the (sensitive) personal data of patient, the report’s real focus is on the GP’s professional competence. One’s professional reputation was within the scope of Article 8: in Mkolajova v. Slovakia

Nor did the decision take adequate account of DB’s express refusal of consent.

The judge thought that the potential significance of the use of the report in litigation was two-fold. First, the information was not being sought for the purpose contemplated by the Directive, namely to protect P’s privacy by ensuring the accuracy of the personal data. Secondly, in obtaining the document by this route meant that the GP would be deprived of the protection provided by the ordinary civil procedure rules for disclosure. That route provides both a less restrictive interference with the GP’s privacy right and the appropriate procedure for the GP’s real purpose in seeking the document.

The GMC attached considerable importance to transparency and equality of treatment. Whilst of general importance, they were not factors of significant weight for the purpose of the balancing exercise required by statute. Insufficient weight was given to the GP’s wish to preserve his right of privacy or to his assessment and concern about potential risk to his professional reputation.

Hence the decision was unlawful.

The judge was invited to give some guidelines for future cases. He was reluctant to go too far, but at [88] stated the following

(1) it is essential to keep in mind that the exercise involves a balance between the respective privacy rights of data subjects;

(2) in the absence of consent, the rebuttable presumption or starting point is against disclosure (Durant). Furthermore the express refusal of consent is a specific factor to be taken into account;

(3) if it appears that the sole or dominant purpose is to obtain a document for the purpose of a claim against the other data subject, that is a weighty factor in favour of refusal, on the basis that the more appropriate forum is the Court procedure under CPR 31.


It is interesting that such a dispute between patient, GP and GMC had not previously got to court. The strong steer from the judge is that, even if the GMC had worded its response rather more closely following the DPA, it could not lawfully have ruled in favour of the patient. The key, and unsurprising, finding was that the report was really all about the GP’s personal data, rather than the patient’s. That, coupled with the presumption of non-disclosure in the absence of consent, essentially foreclosed the patient’s request.

Sign up to free human rights updates by email, Facebook, Twitter or RSS

Related posts:


  1. Eric says:


    As someone with a “professional reputation”,I’m surprised to learn that my rights are considered to be engaged at all when a subject access request is made in relation to my client files – let alone that a Court might rule my rights outweigh those of my client. It is certainly not something which has occurred to my employer – who responds to SARs without even making the professional data subjects aware.

  2. JM says:

    it all sounds a bit odd and made up to me….nobody abides by the DPA anyway? I know this from personal experience over past 25 years….they will not stop giving and selling personal information to anybody and everybody whilst refusing to give me access to it….and besides that they’re in the process of publishing everybody’s on the Internet now are they not? so presumably this case dates from 20 + years back…..?

    hence I now refuse all forms of medical attention for that reason and many others. Not that they actually ever bother asking for consent! They consider it reason enough to put people in mental prisons whilst sniggering like lil school boys… can the law work for somebody like me? :-(

Comments are closed.

Welcome to the UKHRB

This blog is run by 1 Crown Office Row barristers' chambers. Subscribe for free updates here. The blog's editorial team is:
Commissioning Editor: Jonathan Metzer
Editorial Team: Rosalind English
Angus McCullough QC David Hart QC
Martin Downs
Jim Duffy

Free email updates

Enter your email address to subscribe to this blog for free and receive weekly notifications of new posts by email.




This blog is maintained for information purposes only. It is not intended to be a source of legal advice and must not be relied upon as such. Blog posts reflect the views and opinions of their individual authors, not of chambers as a whole.

Our privacy policy can be found on our ‘subscribe’ page or by clicking here.

%d bloggers like this: