2023-02-01 11:58:32
The First Tier Tribunal (General Regulatory Chamber) has just ruled on a request under the Freedom of Information Act 2000 (FoIA) by an unhappy patient for information about a doctor whose competence the patient sought to challenge. The ruling is likely to be equally applicable to pharmacists, pharmacy technicians and other healthcare professionals.
The case is Giovanni Marcheselli v (1) the Information Commissioner and (2) the General Medical Council [2023] UKFTT 00076 (GRC).
In September 2019 Mr Marcheselli raised a concern with the General Medical Council (GMC) about the fitness to practise of a doctor alleging that he and his family had been harmed by the doctor’s actions which he said had brought the profession into disrepute. In November 2019 he raised further allegations with the GMC about a second doctor. The GMC decided not to open an investigation into the issues raised by the appellant about either doctor. Mr Marcheselli requested a review of the GMC’s decisions which was referred to the GMC’s review team in accordance with the GMC Rules. The review concluded that a fresh decision was not necessary and the original decision to close the matter would stand.
Mr Marcheselli wrote to the GMC to request information under FOIA. Specifically, Mr Marcheselli asked for:
- Names of Designated body and / or Annual Appraisal Doctor / Responsible officer for last five years: 2019, 2018, 2017, 2016, 2015
- Year or date of last revalidation
- Year or date of next revalidation
The GMC told Mr Marcheselli that they were withholding the requested information under section 40(2) FOIA as it was the doctor’s personal data. Section 40(2) of the Act exempts personal data from the Act if any of three conditions (paraphrased below) are met:
- disclosure would contravene any of the data protection principles;
- disclosure of the information to a member of the public would contravene UK GDPR (a right to object to processing);
- a right of access by the data subject would be withheld under the Data Protection Act 2018.
Mr Marcheselli complained to the Information Commissioner who concluded that the GMC is entitled to withhold the information under section 40(2). The Information Commissioner held that for the processing to be lawful, a three-part test had to be satisfied:
- Legitimate interest test: whether a legitimate interest is being pursued in the request for information
- Necessity test: whether disclosure of the information is necessary to meet the legitimate interest in question;
- Balancing test: whether the above interests override the legitimate interest(s) or fundamental rights and freedoms of the data subject.
Mr Marcheselli appealed to the First Tier Tribunal.
The Tribunal ruled that the primary case to be considered was Goldsmith International Business School v Information Commissioner and Home Office [2014] UKUT 563 (AAC). In that case, the Tribunal ruled that a “reasonable expectation of privacy’ is central to the engagement of an individual’s rights under Article 8 of the European Convention on Human Rights (“ECHR”). The analysis of fairness and of condition 6(1)(f) will therefore be applied in accordance with ECHR principles of proportionality meaning that disclosure can only take place if it would be reasonably necessary for the purposes of a ‘pressing social need’ and it must be the least intrusive way of achieving that aim.”
The Tribunal concluded that all of the information requested by the appellant in the three questions that made up his request was personal data because it relates to a living individual and, when coupled with the terms of the request, that individual is clearly identifiable from and in relation to it. In the application of the three-part test, the Tribunal agreed with the Information Commissioner in the decision notice that only the first part of the test was satisfied. The Tribunal said:
“We accept that there are legitimate interests in transparency, concerns about the doctor’s safety and concerns about the GMC’s revalidation process. Members of the public, have a legitimate interest in transparency about the GMC’s discharge of its regulatory functions, including oversight of the suitability and fitness to practise of registrant doctors.
However, the processing (disclosure) is not necessary because it would not further any legitimate interest. The appellant’s case is that the registration history of the named doctor would reveal safety issues for patients. However, the information he requests is procedural and formulaic and at most would reveal only the variety in the doctor’s career which of itself in not capable of properly founding any inference about the safety of their practice. Whether or not a doctor has had a varied career, of itself, says nothing about their fitness to practise, safety or competence.
The requested personal data would not further the legitimate interests because there is no connection between the legitimate interests on which the appellant relies and the personal data he seeks. Even if disclosure of this personal data were connected to any such legitimate interests, it would not be reasonably necessary for the furtherance of those interests. Such information would not help individuals explore or take further any concerns they may have about particular doctors, and it would not help them scrutinise the GMC’s discharge of its regulatory functions.
Even though we have concluded that the second part of the test is not satisfied and this would suffice to dispose of the point we have gone on to consider the third aspect in the event we are in error on that point.
We have decided that the processing is unwarranted, or overridden, in this case by reason of prejudice to the data subject’s rights, freedoms and legitimate interests. That is because a. The data subject has a reasonable expectation of privacy which would be undermined by such disclosure
- The information has never been published or was not published at the time of the request and response to that request
- Disclosure under FOIA would be a departure from the published policy and usual practice of the GMC
- Disclosure under FOIA is unrestricted as to the use that the information may be put to be the requestor or the world at large
Disclosure of this information would mean that the named doctor would be being treated in a different way to other doctors. Any disclosure could be distressing to the named doctor and facilitate private investigations more properly conducted by the regulator.
To the extent there is a need to consider the named doctor’s rights under Article 8 ECHR we have concluded that the disclosure of this data would be unlawful because
- The doctor reasonably expected the GMC to keep the information private
- Its public disclosure would be liable to cause upset
- No “pressing social need” would be furthered by that disclosure,
- Public disclosure would be unnecessary and disproportionate.
As neither the second or third part of the three part test is satisfied the processing of the named doctor’s personal data by disclosure as requested under FOIA would not be lawful because none of the reasons listed in Article 6(1) applies to the processing. Thus such processing would contravene the first data protection principle set out in Article 5(1)(a) of the GDPR…and therefore it is exempt pursuant to section 40(2) FOIA.”