First-tier Tribunal
General Regulatory Chamber
Information Rights
Appeal Reference: EA/2019/0203
Heard at Bristol
On 12 December 2019
Before
JUDGE HAZEL OLIVER
MRS SUZANNE COSGRAVE
MR JOHN RANDALL
Between
MR MATTHEW KENDALL
Appellant
and
INFORMATION COMMISSIONER
Respondent
and
GENERAL MEDICAL COUNCIL
Second Respondent
DECISION
The appeal is dismissed.
REASONS
Background to Appeal
1. This appeal is against a decision of the Information Commissioner (the “Commissioner”)
dated 15 May 2019 (FS50826510, the “Decision Notice). It concerns information sought from
the General Medical Council (“GMC”) about whether a named doctor was subject to a GMC
investigation.
2. The parties opted for paper determination of the appeal. The Tribunal is satisfied that it
can properly determine the issues without a hearing within rule 32(1)(b) of The Tribunal
Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 (as amended).
3. On 28 January 2019 the appellant made the following request for information (the
“Request”):
“...under freedom of information I would like to know if [name redacted] was subject of a
GMC investigation at the time she treated [appellant’s relative] and if she is subject to one
at this time”
4. The GMC responded on 29 January 2019. It refused to confirm or deny whether it held
the requested information as it was third party personal data, under section 40(5B) (a)(i) of the
Freedom of Information Act 2000 (“FOIA”). The GMC provided some advice on how to access
publicly available information about a doctor. The appellant requested a review on 29 January,
on the grounds that the information “has a direct relevance to our complaint any potential
criminal or civil action we may wish to take against [name redacted] or the Hospital Trust”. The
Trust replied on 1 March 2019, and maintained that publicly confirming or denying whether they
hold the information would breach the first data protection principle.
5. The appellant complained to the Commissioner on 4 March 2019. The Commissioner
issued her Decision Notice on 15 May 2019, and decided that the GMC had applied section
40(5B) (a)(i) correctly. Providing a confirmation or denial would contravene one of the data
protection principles set out in Article 5 of the General Data Protection Regulation (“GDPR”).
The Commissioner found that:
a. Confirming or denying that the information was held would disclose whether or not the
named doctor had been the subject of a GMC investigation, which would disclose a
third party’s personal data.
b. Applying the processing condition in Article 6(1)(f) GDPR, the appellant did have a
legitimate interest in the requested information – both a personal interest as the doctor
treated one of his relatives, and a public interest in information about a person they
permit to treat them.
c. However, confirming whether the information is held is not necessary. The GMC
considers it reasonable for doctors and complainants to expect that complaints will be
treated as confidential. It is arguable that the interests described by the appellant are
met by the GMC’s current practice of making information publicly available only if a
case progresses to a public hearing or the doctor receives a sanction on their
registration.
d. In light of this finding it was not necessary to go on to consider the balance between
the legitimate interests and the data subject’s interests or fundamental rights and
freedoms, or whether a confirmation or denial would be fair and transparent.
The Appeal
6. The appellant appealed against the Commissioner’s decision on 8 June 2019. The
grounds given for appeal are based on the Commissioner’s application of the necessity test:
a. Information made publicly available by the GMC depends on the quality of GMC
investigations, and only robust investigations would allow the publication process to
be relied on and warrant public trust. The appellant says that the GMC refused to
obtain information from a key witness in his case, the witness did not respond to the
appellant’s requests, and the complaint was closed without this key witness being
investigated. This means there is no information on the GMC website about these
concerns, that another member of the public could see and use to make informed
decisions.
b. The appellant is not able to obtain information through other means, when a failure to
investigate by the GMC would result in no publication.
c. The GMC decides itself what to disclose. Some further information could be disclosed
while keeping confidentiality over the detail of a specific complaint – e.g. numbers of
complaints and findings.
d. Publication would enhance the performance of doctors overall, if they knew more
information would be available.
e. The Commissioner should have made a determination on the balancing test, and the
fairness and transparency of declining the request.
f. The doctor in question continues to practise at the hospital, and others being treated
by that doctor would want to know that the doctor was the subject of his complaint for
gross negligence.
7. The Commissioner’s response maintains that section 40(5B) (a)(i) of FOIA was applied
correctly:
a. Confirmation or denial was not reasonably necessary to meet the legitimate interest
in this case. This would not address wider concerns about the GMC’s process for
investigating complaints. It is also not necessary in order for the appellant to pursue
a complaint or take further legal action about his relative’s treatment.
b. Confirmation or denial that the information was held would also be unwarranted under
the balancing test and unfair. It is reasonable for doctors and complainants to expect
that complaints and investigations will be treated as confidential, except where there
is a hearing or sanction on registration. It would not be fair to publicly confirm that a
doctor has been the subject of an investigation where no fault has been found or
sanction imposed, and the GMC can consider the “mosaic effect” of denying
information is held in relation to some doctors.
8. The GMC has also submitted a response which maintains its reliance on section 40(5B)
FOIA.
a. The GMC’s standard practice is to neither confirm nor deny whether information is
held about a particular medical practitioner where that information is not already in the
public domain through the regulatory and publication processes. This is because it is
“fundamentally unfair” to a doctor to have their reputation undermined, to the world,
where a complaint has not been established or proven under the statutory process.
Confirmation or denial would not be fair.
b. The GMC accepts the appellant has a legitimate interest in the information, which
might be relevant to further complaints or litigation. The GMC does not accept a wider
public interest in the information, as the request is inherently personal, and a
confirmation or denial tells the public nothing about fitness to practise.
c. The appellant’s aims can be achieved in ways which better protect the data subject.
It will not show whether his relative’s care was negligent, and any litigation would
engage duties of disclosure which may provide similar information but with restrictions
on its use outside the litigation. It will tell the public nothing about the GMC’s
performance of its functions, and individual decisions can be challenged by seeking a
rule 12 review or judicial review. The balancing test clearly favours maintenance of
the exemption.
9. The appellant has provided replies to the responses from both respondents, which we have
considered as part of our discussion and conclusions below.
Applicable law
10. The relevant provisions of FOIA are as follows.
1 General right of access to information held by public authorities.
(1) Any person making a request for information to a public authority is entitled—
(a) to be informed in writing by the public authority whether it holds
information of the description specified in the request, and
(b) if that is the case, to have that information communicated to him.
……
40 Personal information.
(1) Any information to which a request for information relates is exempt
information if it constitutes personal data of which the applicant is the data
subject.
(2) Any information to which a request for information relates is also exempt
information if –
(a) it constitutes personal data which do not fall within subsection (1), and
(b) the first, second or third condition below is satisfied.
(3A) The first condition is that the disclosure of the information to a member of the
public otherwise than under this Act would contravene –
(a) any of the data protection principles, or
(b) would do so if the exemptions in section 24(1) of the Data Protection Act
2018 (manual unstructured data held by public authorities) were
disregarded.
…….
(5A) The duty to confirm or deny does not arise in relation to information which is
(or if it were held by the public authority would be) exempt information by virtue
of subsection (1).
(5B) The duty to confirm or deny does not arise in relation to other information if or
to the extent that any of the following applies –
(a) Giving a member of the public the confirmation or denial that would have
to be given to comply with section 1(1)(a) –
(i) would (apart from this Act) contravene any of the data protection
principles, or
(ii) would do so if the exemptions in section 24(1) of the Data
Protection Act 2018 (manual unstructured data held by public
authorities) were disregarded.
.…..
58 Determination of appeals.
(1) If on an appeal under section 57 the Tribunal considers—
(a) that the notice against which the appeal is brought is not in accordance
with the law, or
(b) to the extent that the notice involved an exercise of discretion by the
Commissioner, that he ought to have exercised his discretion
differently,
the Tribunal shall allow the appeal or substitute such other notice as could have
been served by the Commissioner; and in any other case the Tribunal shall
dismiss the appeal.
(2) On such an appeal, the Tribunal may review any finding of fact on which the
notice in question was based.
11. The data protection principles are those set out in Article 5(1) of the GDPR, and section
34(1) of the Data Protection Act 2018 (“DPA”). Section 3(2) of the DPA defines “personal data”
as “any information relating to an identified or identifiable living individual”.
12. The first data protection principle under Article 5(1)(a) GDPR provides that, “Personal data
shall be processed lawfully, fairly and in a transparent manner in relation to the data subject”.
13. In order to be lawful, processing must meet one of the conditions in Article 6(1) GDPR.
The relevant condition in this case is condition 6(1)(f) GDPR – “processing is necessary for the
purposes of the legitimate interests pursued by the controller or by a third party, except where
such interests are overridden by the interests or fundamental rights and freedoms of the data
subject which require protection of personal data, in particular where the data subject is a child.”
14. This involves consideration of three questions (as set out by Lady Hale DP in South
Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55):
(i) Is the data controller or third party or parties to whom the data are disclosed pursuing
a legitimate interest or interests?
(ii) Is the processing involved necessary for the purposes of those interests?
(iii) Is the processing unwarranted in this case by reason of prejudice to the rights and
freedoms or legitimate interests of the data subject?
The wording of question (iii) is taken from the Data Protection Act 1998, which is now replaced
by the DPA and GDPR. This should now reflect the words used in the GDPR – whether such
interests are overridden by the interests or fundamental rights and freedoms of the data subject
which require protection of personal data.
15. In Goldsmith International Business School v Information Commissioner and the Home
Office [2014] UKUT 563 (AAC), Upper Tribunal Judge Wikeley set out eight propositions taken
from case law as to the approach to answering these questions.
a. Proposition 1 – Condition 6(1) requires the above three questions to be asked.
b. Proposition 2 – the test of necessity under stage (ii) must be met before the balancing
test under stage (iii) is applied.
c. Proposition 3 – “Necessity” carries its ordinary English meaning, being more than
desirable but less than indispensable or absolute necessity.
d. Proposition 4 – The test is one of “reasonable necessity”, reflecting European
jurisprudence on proportionality.
e. Proposition 5 – This involves the consideration of alternative measures, so the
measure must be the least restrictive means of achieving the legitimate aim in question.
f. Proposition 6 – Where no Article 8 privacy rights are in issue, the question posed
under Proposition 1 can be resolved at the necessity stage.
g. Proposition 7 – Where Article 8 privacy rights are in issue, the question posed under
Proposition 1 can only be resolved after considering the excessive interference
question.
h. Proposition 8 – the Supreme Court in South Lanarkshire did not purport to suggest a
test which is any different to that adopted by the Information Tribunal in Corporate
Officer (Information Tribunal).
Evidence
16. We had an agreed bundle of documents, all of which we have read. The appellant also
submitted an additional document, an email to the GMC dated 22 September 2019, which he
says shows that the chances of obtaining information regarding a doctor based on the GMC’s
publication process is extremely remote.
17. The open bundle was edited to prevent the name of the doctor from being disclosed. We
have redacted the name of the doctor in this decision. We have also redacted details of the
appellant’s relative, and do not refer in the decision to any other specific details which might
enable the doctor to be identified.
Discussion and Conclusions
18. In accordance with section 58 FOIA, our role is to consider whether the Commissioner’s
Decision Notice was in accordance with the law. As set out in section 58(2), we may review
any finding of fact on which the notice in question was based. This means that we can review
all of the evidence provided to us and make our own decision as to whether or not the Trust
was entitled to refuse to provide the requested information. Our role does not involve
addressing detailed criticisms of the Commissioner’s investigation. We may or may not agree
with the Commissioner’s conclusions.
19. The requested information clearly contains personal data, as it asks whether a named
doctor has been the subject of GMC investigations. The question for the Tribunal is whether
the GMC can refuse to confirm or deny that this information is held. The duty to confirm or deny
does not apply if doing so would contravene any of the data protection principles. These
principles require the doctor’s personal data to be processed lawfully, fairly and transparently.
20. The GMC has provided some background to its complaints and investigations process.
The GMC has a statutory function to consider whether complaints made to it about a registered
practitioner warrant further investigation and possible reference to a Medical Practitioners
Tribunal. An investigation into a complaint against a medical practitioner starts with a
provisional enquiry by the Registrar, who may then refer the matter to Case Examiners to
decide on what action should be taken. The Case Examiners may refer the matter to the
Tribunal, close it with no action, receive undertakings from the practitioner, or issue a warning.
Only in some cases is an allegation referred for consideration by the Investigation Committee
or Tribunal. A complainant who is dissatisfied with a decision not to progress a complaint can
seek review under rule 12 of the relevant rules, or pursue a judicial review. The GMC’s function
is based on whether fitness to practise is impaired. It is not a general complaints investigation
function. Not every error or breach by a medical practitioner may impair fitness to practice.
The GMC’s role is to assess whether the practitioner’s fitness to practice is actually impaired
at the time of the assessment or hearing.
21. In order for processing of the doctor’s personal data to be lawful, one of the conditions in
the GDPR must apply. The relevant condition here is 6(1)(f) GDPR. We apply the facts to the
three questions relevant to this condition as follows.
22. Is the data controller or third party or parties to whom the data are disclosed
pursuing a legitimate interest or interests? The parties agree that the appellant is pursuing
legitimate interests, but disagree as to what those interests are.
a. The appellant argues that there are two main legitimate interests – his personal
interest in obtaining information for the purposes of pursuing a case about the
treatment of his relative, and a public interest in knowledge about serious complaints
in relation to people who are treating them. This is put in the context of failures in
GMC investigations, and as helping to improve doctors’ performance.
b. The Commissioner accepts that there are legitimate interests for the appellant in
pursuing his own complaint or legal action, but questions a public interest in the
absence of evidence that other members of the public had similar concerns. The GMC
accepts the appellant’s personal interests only, and says there is no public interest in
the information because confirming or denying the existence of complaints says
nothing about fitness to practise.
c. We find that both the appellant and the wider public have legitimate interests in
disclosure of the data. The appellant potentially wishes to pursue civil or criminal
action against the doctor or the NHS Trust in relation to the treatment of his relative.
Information about whether the doctor was the subject of a GMC investigation may be
relevant to such claims. The wider public also has a legitimate interest in knowing if
the doctor responsible for their treatment is the subject of serious complaints about
their practice, whether or not the GMC has made a final determination. The absence
of evidence about concerns raised by other members of the public does not change
this, as knowledge of just one serious complaint may be sufficient to further this
interest.
23. Is disclosure (through confirmation or denial) necessary for these legitimate
interests? We have assessed this on the basis of the tests set out above, by considering
reasonable necessity and whether there are less restrictive means of achieving the legitimate
aim in question.
24. The appellant’s personal interest in the information is based on potential legal claims. We
find that confirmation or denial by the GMC as to whether there were complaints under
investigation against the named doctor under FOIA is not reasonably necessary for pursuing
this interest, and there are other means of achieving this which are less intrusive.
25. The existence of complaints against the doctor at the time of the appellant’s relative’s
treatment might be relevant to legal claims, in that it would show that others had complained
about the doctor’s practice. Similarly, the existence of complaints at the time of the Request
would indicate concerns from others about the doctor. However, the fact of a complaint
investigation by the GMC does not indicate that the complaint has any merit. This information
is not necessary for the appellant to decide whether to bring a claim, because confirmation as
to whether or not other complaints have been investigated is not evidence that the doctor was
negligent in the treatment of the appellant’s relative. If a claim is made, disclosure of
information about complaints and GMC investigations may be required if it is relevant to the
case – including more detail than a simple confirmation or denial. This would help the
appellant’s interests in bringing the claim, but would be done under the usual duties of
disclosure with restrictions on how the information may be used. This is a less intrusive and
more effective way of furthering the appellant’s interests in the information than disclosure to
the world at large under FOIA.
26. The public interest is based on knowing whether a treating doctor is the subject of serious
complaints and so fit to be treating them. We find that confirmation or denial by the GMC as to
whether there were complaints under investigation against the named doctor under FOIA is not
reasonably necessary for pursuing this interest. The existence of a complaint which is under
investigation by the GMC provides no information about the doctor’s actual fitness to practise.
The GMC receives many complaints, and only a minority proceed to a finding that the doctor is
not fit to practise. The GMC publishes decisions by the relevant Tribunals and Investigation
Committees, and undertakings agreed with individual doctors. Tribunal hearings are also
public. These steps provide the public with information about enforcement actions and
sanctions that have actually taken place. This furthers the public interest in knowing whether
the GMC has found a problem with a doctor’s fitness to practise, or has sufficient concerns for
the matter to progress to a public Tribunal hearing. This is a more accurate way of providing
such information to the public than disclosure of the existence of investigations into complaints
which have not resulted in action by the GMC.
27. The appellant makes the point that he considers the GMC investigative process is
unsatisfactory because the majority of complaints are never formally investigated, and the
chances of obtaining information about a doctor based on the GMC’s publication process is
extremely remote. We do not agree that this makes it reasonably necessary for personal data
about a named doctor to be disclosed under FOIA. If there has been poor performance in an
investigation by the GMC, this can be challenged by way of a review under the relevant rule
12, or through judicial review. As already noted, the existence of a complaint against a doctor
does not indicate that the complaint has any merit or that there is any impairment of the doctor’s
fitness to practise under the GMC regime.
28. The appellant submits in his response to the GMC that this approach is inherently unfair
to the public. He says that confirmation would tell the public that a doctor who was the subject
of a current complaint had been permitted to continue to practise by the hospital, and this is
relevant to both the hospital’s and the doctor’s negligence. We accept that there would be a
public interest in knowing that a doctor who is not fit to practise has been allowed to continue
working without appropriate safeguards. But, confirmation or denial of the existence of a
complaint investigation does not provide this information. As already noted, the existence of a
complaint does not mean there is any actual problem with a doctor’s practise, and so
publication of details about complaints would be misleading. The GMC is concerned only with
whether there is an ongoing problem with a doctor’s fitness to practise. If so, details of
enforcement actions and sanctions are published and so made available to the public.
29. The appellant also submits that publication would enhance the performance of doctors
overall, if they knew more information would be available. We do not agree with this.
Publication of information about complaints which have not been substantiated would be unfair
to the doctor, and in our view, would be more likely to inhibit a doctor’s practice than enhance
performance.
30. The appellant also complains that the GMC decides itself what to disclose, and further
information could be disclosed while keeping confidentiality over the detail of a specific
complaint – e.g. numbers of complaints and findings. This challenge to the GMC’s practice is
outside our remit. We are limited to considering whether the GMC should have answered the
appellant’s specific Request.
31. Are such interests overridden by the interests or fundamental rights and freedoms
of the data subject which require protection of personal data? It is not necessary for us
to consider this point in any detail, as we have found that disclosure of the information (by way
of confirmation or denial) is not necessary for purposes of the legitimate interests put forward
by the appellant. We note that the doctor does have a reasonable expectation of privacy in
relation to this information, in light of the GMC’s clear policy about when information about
complaints and fitness to practise are made publicly available. We also note that this
expectation of privacy would be significantly undermined by disclosure of the existence of
investigations into complaints which have not been substantiated or where no finding of
impaired fitness to practise is made. We do not need to go on to determine the balancing test,
as we have found no interests for which disclosure of the personal data is reasonably necessary.
32. The appellant provided details of the background in relation to the difficulties he says he
experienced with the medical care of his relative, and we understand that he says he is seeking
information to help protect the public as well as for the purposes of his own case. However,
for the reasons set out above, these interests do not require disclosure of the requested
information about a named doctor under FOIA. The GMC is entitled to refuse to confirm or
deny the existence of the requested information under section 40(5B) (a)(i) FOIA.
Signed: Hazel Oliver
Judge of the First-tier Tribunal
Date: 20 December 2019
Promulgated date: