Case No: EA/2013/0014 The appellant, A, had previously made a complaint against X, a GMC registered doctor. The GMC had made initial enquiries but decided that there was no reason to proceed with a
Case No: EA/2013/0014
The appellant, A, had previously made a complaint against X, a GMC registered doctor. The GMC had made initial enquiries but decided that there was no reason to proceed with a full investigation and the case was closed.
Following this decision, A wrote to the GMC making various requests, which the GMC categorised as (i) a request for explanations of the GMC’s stance on several aspects of the original complaint; (ii) a request to be informed whether personal data of which he was the data subject was being processed by the GMC, and if so, to have that data communicated to him under section 7 of the Data Protection Act 1998 (“the Subject Access Request") and (iii) a request for information held by the GMC under section 1 of the Freedom of Information Act 2000 (“the Information Request").
The GMC responded to the Subject Access Request by providing A with redacted copies of documents from the file relating to the complaint. The effect of the disclosure was to provide A with substantially the whole record of the GMC’s handling of the original complaint.
Whilst issues surrounding the way in which the GMC handled the Subject Access Request were outside the jurisdiction of the Tribunal, these were considered as background to the assessment of the GMC's handling of the Information Request.
The First Tier Tribunal expressed surprise about the disclosure via the Subject Access Request, stating that it was "very likely" that the disclosed information did not constitute A's personal data, but did constitute the personal data of X. Further, the First Tier Tribunal added that as A had already identified X, it was arguable that disclosing redacted copies of extracts from the case file did not protect that personal data. The Tribunal added that it was at least arguable that the disclosed information constituted exempt data under section 31(2)(a)(iii) of the DPA.
Looking then at the Information Request, in this case, the GMC as the Data Controller had responded to the FOIA request stating that they were entitled to issue a "neither confirm nor deny" response on the basis that the information requested was exempt from disclosure under section 40(2) of the FOIA (which provides that information is exempt information if it constitutes personal data of a third party, the disclosure of which would contravene any of the data protection principles).
It was argued on behalf of the GMC that, even if the GMC had been too generous in the disclosure when responding to the subject access request, this eventuality would not alter the reasonable expectation of doctors to have a level of protection from disclosure to the public in response to a FOIA request.
The Tribunal held that information about a complaint made to a disciplinary panel of a profession constituted the personal data of the individual against whom the complaint was made. The doctor was entitled to privacy in respect of the complaint made against him and the details of his employer.
The conclusion in this particular case was not viewed to be preserving privacy, as technically the information and decision had already been disclosed to the appellant as part of the subject access request. However, the Tribunal recognised the value of maintaining a policy which had been well established. It was therefore, concluded that the GMC was entitled to issue a neither confirm nor deny response to the Information Request. The Information Commissioner's decision was upheld and the appeal was dismissed.
(Date of decision: 2 August 2013)
The appellant, A, had previously made a complaint against X, a GMC registered doctor. The GMC had made initial enquiries but decided that there was no reason to proceed with a full investigation and the case was closed.
Following this decision, A wrote to the GMC making various requests, which the GMC categorised as (i) a request for explanations of the GMC’s stance on several aspects of the original complaint; (ii) a request to be informed whether personal data of which he was the data subject was being processed by the GMC, and if so, to have that data communicated to him under section 7 of the Data Protection Act 1998 (“the Subject Access Request") and (iii) a request for information held by the GMC under section 1 of the Freedom of Information Act 2000 (“the Information Request").
The GMC responded to the Subject Access Request by providing A with redacted copies of documents from the file relating to the complaint. The effect of the disclosure was to provide A with substantially the whole record of the GMC’s handling of the original complaint.
Whilst issues surrounding the way in which the GMC handled the Subject Access Request were outside the jurisdiction of the Tribunal, these were considered as background to the assessment of the GMC's handling of the Information Request.
The First Tier Tribunal expressed surprise about the disclosure via the Subject Access Request, stating that it was "very likely" that the disclosed information did not constitute A's personal data, but did constitute the personal data of X. Further, the First Tier Tribunal added that as A had already identified X, it was arguable that disclosing redacted copies of extracts from the case file did not protect that personal data. The Tribunal added that it was at least arguable that the disclosed information constituted exempt data under section 31(2)(a)(iii) of the DPA.
Looking then at the Information Request, in this case, the GMC as the Data Controller had responded to the FOIA request stating that they were entitled to issue a "neither confirm nor deny" response on the basis that the information requested was exempt from disclosure under section 40(2) of the FOIA (which provides that information is exempt information if it constitutes personal data of a third party, the disclosure of which would contravene any of the data protection principles).
It was argued on behalf of the GMC that, even if the GMC had been too generous in the disclosure when responding to the subject access request, this eventuality would not alter the reasonable expectation of doctors to have a level of protection from disclosure to the public in response to a FOIA request.
The Tribunal held that information about a complaint made to a disciplinary panel of a profession constituted the personal data of the individual against whom the complaint was made. The doctor was entitled to privacy in respect of the complaint made against him and the details of his employer.
The conclusion in this particular case was not viewed to be preserving privacy, as technically the information and decision had already been disclosed to the appellant as part of the subject access request. However, the Tribunal recognised the value of maintaining a policy which had been well established. It was therefore, concluded that the GMC was entitled to issue a neither confirm nor deny response to the Information Request. The Information Commissioner's decision was upheld and the appeal was dismissed.
(Date of decision: 2 August 2013)