Court of Appeal decision on disclosure of mixed data

The Court of Appeal has overturned a High Court decision on assessing the balance of interests between the requester of a subject access request, and third parties whose data might be disclosed as a result.

What's the issue?

The GMC had commissioned a medical report in relation to a claim by a patient that his GP, a Dr B, had failed to diagnose his cancer in the time he should have done. The patient made a request for disclosure of the full report to the GMC. This was treated as a subject access request (SAR) under the Data Protection Act 1998. Dr B applied for an injunction preventing the report's disclosure, on the basis that it contained his personal data and disclosure would infringe his privacy rights, and that the SAR had been made solely in contemplation of litigation.

The injunction was granted by the High Court. The High Court followed Durant in determining that the absence of consent to disclosure by a third party in cases of SARs involving mixed data, led to a presumption against disclosure. In addition, Soole J held that the fact that the purpose could have been inferred to have been made for litigation rather than to protect privacy, was a weighty factor against disclosure.

The decision appeared to confirm that subject access rights are curtailed where the request is made primarily for litigation purposes and also placed considerable emphasis on the rights of the third party to refuse consent to disclosure.

What's the development?

The Court of Appeal has overturned the High Court decision.

The GMC appealed arguing the High Court had been wrong to hold that:

• In the case of 'mixed personal data' there is a rebuttable presumption against disclosure.
• A weighty factor in refusing disclosure would be where the SAR is made solely or for the dominant purpose of obtaining information for litigation purposes.
• That the GMC had given inadequate consideration to the privacy rights of Dr B. And
• That the High Court had substituted its own assessment of the case for the GMC's, rather than reviewing the decision of the GMC, and had over-estimated the likely effect of disclosure of the report on Dr B.

The Court of Appeal upheld the GMC's appeal, holding:

• The rebuttable presumption in relation to disclosure of mixed data, did not come from ratio in the Durant judgement. The test to be applied by data controllers is whether the disclosure of third party data without consent is reasonable on the balance of interests of the third party and the maker of the SAR. This means controllers have a significant margin of discretion to make their assessment.
• The interests of the requester of the information should not be devalued because they are motivated by requiring information for litigation purposes. Sales LJ considered that the fact the request related to the patient's sensitive data was a factor in favour of releasing the information, that it was hard to see what legitimate privacy reason Dr B had for resisting disclosure, and that where the desire of the third party to prevent disclosure is not privacy-related but is to avoid litigation, that is peripheral to the balancing exercise between the interests of the requester and the objector.
• The GMC had considered Dr B's privacy rights.
• The decision was with the data controller about whether or not to disclose. The discretion is wide as to which factors are relevant to the balancing exercise. The High Court had made its own assessment rather than analysing that of the GMC.

What does this mean for you?

While this decision relates to previous data protection law, subject access has not changed significantly under GDPR, so the judgment remains relevant.

The judgment is likely to be welcomed by data controllers who have had their wide discretion when balancing competing rights confirmed. Data subjects making requests for disclosure of mixed data, will benefit from the decision that contemplation of litigation as a motivating factor behind the SAR, is not to be given special weight in mixed data cases where balancing interests of the requester and the third party have to be assessed.