The Court of Appeal has overturned a High Court decision on assessing the balance of interests between the requester of a subject access request, and third parties whose data might be disclosed as a result.
The GMC had commissioned a medical report in relation to a claim by a patient that his GP, a Dr B, had failed to diagnose his cancer in the time he should have done. The patient made a request for disclosure of the full report to the GMC. This was treated as a subject access request (SAR) under the Data Protection Act 1998. Dr B applied for an injunction preventing the report's disclosure, on the basis that it contained his personal data and disclosure would infringe his privacy rights, and that the SAR had been made solely in contemplation of litigation.
The injunction was granted by the High Court. The High Court followed Durant in determining that the absence of consent to disclosure by a third party in cases of SARs involving mixed data, led to a presumption against disclosure. In addition, Soole J held that the fact that the purpose could have been inferred to have been made for litigation rather than to protect privacy, was a weighty factor against disclosure.
The decision appeared to confirm that subject access rights are curtailed where the request is made primarily for litigation purposes and also placed considerable emphasis on the rights of the third party to refuse consent to disclosure.
The Court of Appeal has overturned the High Court decision.
The GMC appealed arguing the High Court had been wrong to hold that:
The Court of Appeal upheld the GMC's appeal, holding:
While this decision relates to previous data protection law, subject access has not changed significantly under GDPR, so the judgment remains relevant.
The judgment is likely to be welcomed by data controllers who have had their wide discretion when balancing competing rights confirmed. Data subjects making requests for disclosure of mixed data, will benefit from the decision that contemplation of litigation as a motivating factor behind the SAR, is not to be given special weight in mixed data cases where balancing interests of the requester and the third party have to be assessed.