Appeal number: EA/2019/0461P
FIRST-TIER TRIBUNAL
GENERAL REGULATORY CHAMBER
INFORMATION RIGHTS
KOLADE KAYODE Appellant
- and -
(1)THE INFORMATION COMMISSIONER Respondents
(2) THE GENERAL MEDICAL COUNCIL
Before:
JUDGE ALISON MCKENNA (CP)
Determined on the papers, the Tribunal sitting in Chambers on 8 July 2020
© CROWN COPYRIGHT 2020
MODE OF HEARING
1. This determination was conducted by a Judge, sitting alone. The Tribunal was
satisfied that it was appropriate to compose the panel in this way, having regard to
paragraph 6 (a) of the Senior President’s Pilot Practice Direction dated 19 March 20201
and the desirability of determining all cases which are capable of determination by the
most expeditious means possible during the pandemic.
2. The parties and the Tribunal agreed that this matter was suitable for determination
on the papers in accordance with rule 32 Chamber’s Procedure Rules2.
3. The Tribunal considered an agreed open bundle of evidence comprising pages 1 to
354, plus additional papers consisting of the Information Commissioner’s final
submission. There is no closed bundle.
DECISION
4. The appeal is dismissed.
REASONS
Background to Appeal
5. The Appellant made an information request under the Freedom of Information Act
2000 (“FOIA”) to the General Medical Council (“GMC”) on 4 June 2019. He
requested a copy of the Fitness to Practice Panel determination for a named doctor,
in relation to a hearing which has taken place in 2008, before the establishment of
the Medical Practitioners Tribunal Service (“MPTS”).
6. GMC originally refused to confirm or deny whether it held the requested
information but on internal review on 6 September 2019, GMC confirmed that it
held the requested information but refused to disclose it in reliance on s. 40 (2)
FOIA. The Appellant complained to the Information Commissioner.
7. The Information Commissioner issued a Decision Notice on 25 November 2019
(number FS50872018). The Decision Notice concluded that there was a legitimate
interest in the requested information in view of the requirement for the public to
understand that doctors are appropriately regulated. It also concluded that
disclosure was necessary because the entry on the register alone is insufficient to
meet that legitimate interest. In applying a balancing test, the Decision Notice
1
https://www.judiciary.uk/publications/pilot-practice-direction-panel-composition-in-the-first-tier-
tribunal-and-the-upper-tribunal/
2
https://www.gov.uk/government/publications/general-regulatory-chamber-tribunal-
procedure-rules
2
concluded that the named doctor had a reasonable expectation that the information
would be withheld, taking into account the changed data protections landscape and
the “right to be forgotten” under GDPR. It was noted that GMC had amended its
policy in the light of GDPR so that disclosure was time-limited, so disclosure of the
requested information in this case would have effectively re-introduced its earlier
blanket policy of indefinite disclosure. The Decision Notice concluded that
disclosure of the requested information in this case would be unfair and cause
distress to the doctor concerned so that GMC had been correct to refuse disclosure
in reliance upon s. 40 (2) FOIA.
8. The Appellant appealed to the Tribunal.
The Law
9. Section 40 (2) FOIA provides that information is exempt from disclosure if it is the
personal data of any person other than the requester and where one of the conditions
in s. 40 (3A), (3B) or (4A) is satisfied.
10. Section 40 (3A)(a) FOIA applies where disclosure of the information would
contravene any of the principles in Article 5 of the General Data Protection
Regulation (“GDPR”). This is an absolute exemption, so no public interest test is to
be applied.
11. ‘Personal Data’ is defined by s. 3(2) of the Data Protection Act 2018 as any
information relating to an identified or identifiable living individual.
12. Article 5 (1) (a) GDPR provides that personal data shall be processed lawfully,
fairly and in a transparent manner in relation to the data subject.
13. Lawful processing under Article 6 (1) (f) GDPR requires processing to be necessary
for the purposes of the legitimate interests pursued by the controller or by a third
party except where such interests are overridden by the interests or fundamental
rights and freedoms of the data subject which require protection of personal data,
in particular where the data subject is a child.
14. The Upper Tribunal has endorsed the adoption of a three-part test in considering
whether (i) there is a legitimate interest, (ii) whether disclosure is necessary to meet
that interest if so, (iii) the consideration of a balancing test to weigh those interests
against the rights and freedoms of the data subject. See Goldsmith International
Business School v Information Commissioner and Home Office [2014] UKUT 563
(AAC)3 at [35] to [42]. This was a reiteration of the Supreme Court’s judgment in
South Lanarkshire Council v The Scottish Information Commissioner [2013] UKSC
554 at [18].
3
https://www.bailii.org/uk/cases/UKUT/AAC/2014/563.html
4
https://www.supremecourt.uk/cases/docs/uksc-2012-0126-judgment.pdf
3
15. In Cox v IC and Home Office [2018] UKUT 119 (AAC)5 Upper Tribunal Judge
Wikeley commented that:
45. Also relevant in the present context is Judge Jacobs’s warning in GR-N v
Information Commissioner and Nursing and Midwifery Council (at paragraph
30) against over-generalised propositions: “is impossible to apply paragraph
6(1) without having regard to the identity of the applicant, the interest pursued
by the request, and the extent to which information is already potentially
available to the public.”
16. The powers of the Tribunal in determining this appeal are set out in s.58 of FOIA,
as follows:
“If on an appeal under section 57 the Tribunal considers -
(a) that the notice against which the appeal is brought is not in
accordance with the law, or
(b) to the extent that the notice involved an exercise of discretion by the
Commissioner, that he ought to have exercised his discretion differently,
the Tribunal shall allow the appeal or substitute such other notice as could
have been served by the Commissioner, and in any other case the Tribunal
shall dismiss the appeal.
On such an appeal, the Tribunal may review any finding of fact on which
the notice in question was based.”
17. The burden of proof in satisfying the Tribunal that the Commissioner’s decision
was wrong in law or involved an inappropriate exercise of discretion rests with the
Appellant. The relevant standard of proof is the balance of probabilities.
18. This appeal is against the Information Commissioner’s Decision, and not the
process of reasoning set out in the Decision Notice – see the Decision of a three-
Judge panel in Information Commissioner v Malnick and the Advisory Committee on
Business Appointments [2018] UKUT 72 (AAC) at [94]6.
Submissions and Evidence
19. By the time of the hearing of this appeal, the Appellant relied on four grounds of
appeal, which I summarise as follows:
5
https://www.gov.uk/administrative-appeals-tribunal-decisions/cox-v-information-commissioner-and-
home-office-2018-ukut-119-aac
6
https://assets.publishing.service.gov.uk/media/5e208b08e5274a6c38aae2a2/_2018__AACR_29ws.pdf
4
(i) That the Decision Notice was wrong in law;
(ii) That the Information Commissioner erred in law when she expressed a view
on the GMC’s policy consultation in 2015 that indefinite publication was
problematic from a data protection view-point;
(iii) That the Information Commissioner erred in law by relying on her own
previously expressed view in the Decision Notice;
(iv) That GMC’s policy is unlawful.
20. The Appellant made submissions in respect of a range of additional factors. To
summarise, his contention is that GMC’s policy is unlawful and that the Information
Commissioner ought not to have endorsed it. He contrasts the position of the GMC
in relation to the information on its own website with that of doctors who bring an
onward appeal so that their information is not subject to the same right to be
forgotten as those who take the matter no further. He also submits that the particular
information requested has in the past been publicly available so that any viewer of
the website could have downloaded it and continue to disseminate it. Thus, that
the Decision Notice failed to consider the extent to which the requested information
is already in the public domain.
21. The Appellant also objects to the reference in the Decision Notice to him not having
put forward a particular justification for disclosure. He submits that there is no legal
requirement for him to do so.
22. The Information Commissioner’s Response dated 28 January 2020 generally
maintained the analysis as set out in the Decision Notice. I refer to her pleaded case
in more detail in respect of her final submissions below, as it has been amended
over time.
23. The Appellant’s Reply to the Information Commissioner’s Response took issue
with the Information Commissioner’s submission that the Appellant was asking the
Tribunal to determine matters outside its jurisdiction. He submitted that his four
grounds of appeal were intrinsically connected. He referred the Tribunal to the case
law on open justice and submitted that GMC’s policy was unlawful in contravening
this principle.
24. The GMC was added as a party to the appeal. Its Response dated 18 February 2020
helpfully clarified its policy for the Tribunal and corrected some misunderstandings
on the part of the Appellant and the Information Commissioner. It asked the
Tribunal to dismiss the appeal and uphold the Decision Notice.
25. In respect of the particular doctor who is the subject of the Appellant’s information
request, GMC submitted that he was erased from the register in 2007, and full
details of his erasure were held on the register until February 2018 when the new
policy took effect. There had throughout that period been a link to the MPTS
determination. Under the new policy, details of the reason for his erasure (fitness
to practice) are no longer published so the MPTS link has been deleted. However,
5
any member of the public can search the medical register and find that he is not
entitled to practice in the UK.
26. GMC accepted that, in response to a FOIA request in 2010, it disclosed details of
all doctors erased from the medical register for fitness to practice reasons since 2005
and that that information was published on the whatdotheyknow.com website.
Information about the particular doctor with whom the Appellant is concerned was
included in that disclosure.
27. GMC’s submission was that there is a limited legitimate interest in disclosure as the
public should understand how doctor’s fitness to practice hearings are conducted.
However, it submitted that the Decision Notice had erred in concluding that there
was an interest related to the use of taxpayers’ money, as GMC is not funded from
the public purse. It was submitted that disclosure is not necessary to meet the
legitimate interest identified as the public is entitled to know whether a doctor is
entitled to practice, and that information is always available. Fitness to practice
hearings are conducted in public and determinations are made available for ten
years, but there is not in GMC’s submission a necessity in relation to the availability
of details of an erasure which took place over ten years ago. It is noted that an
individual may no longer be affected by the issues which caused him or her to
become unfit to practice.
28. It is submitted by GMC that if the Tribunal finds it necessary to conduct the
balancing exercise, then the balance favours non-disclosure in circumstances where
the doctor’s expectation at the time of the request would have been influenced by
the policy, and a breach of his reasonable expectations would cause distress and be
unfair. It is submitted that grounds two, and four fall outside of the Tribunal’s
statutory remit in determining this appeal. It is further submitted that the Decision
Notice did not err in law in referring to the Information Commissioner’s previously
expressed opinion about GMC’s policy.
29. In his Reply to GMC’s Response, the Appellant confirmed his acceptance that the
information requested is personal data. However, he relied on GMC’s statutory
power to publish determinations under s. 35B(4) of the Medical Act 19837 and
submitted that it tipped the balancing test in favour of disclosure. He relied on this
statutory provision as providing a basis for lawful processing “otherwise than under
this Act” under s. 40 FOIA and submitted again that GMC’s policy is unlawful in
seeking to apply GDPR to its pre-existing statutory requirement to publish. He
submitted that there is a mandatory duty to publish fitness to practice information
and not a discretion, as the GMC had submitted. He submitted that the ‘right to be
forgotten’ is a right exercisable by a data subject and does not provide a basis for
the refusal of information under FOIA.
30. GMC filed a further submission dated 16 March 2020, with the permission of the
Tribunal. It submitted that the Appellant was in fact attempting to mount a
7
http://www.legislation.gov.uk/ukpga/1983/54/section/35B
6
challenge to GMC’s policy which it was beyond the Tribunal’s remit to determine.
It submitted that the Appellant should have applied for judicial review if this was
his aim. It resisted the Appellant’s suggestion that these proceedings should be
transferred to a court with jurisdiction to determine that issue.
31. The Appellant filed a “Rejoinder” dated 18 March 2020, in which he made a
submission (possibly amounting to a fresh ground of appeal) that the Decision
Notice was wrong in law for its failure to conclude that the statutory basis for
publication provided by the Medical Act 1983 is a lawful basis for processing under
Article 6 GDPR.
32. The Information Commissioner’s final submissions dated 30 June 2020 note that,
since the filing of her Response, the GMC had clarified the length of time for which
information concerning erased doctors is available on its website and that the
Appellant had (with the permission of the Tribunal) amended his grounds of appeal
in the light of that clarification. In responding to the Appellant’s fourth ground, the
Information Commissioner submitted that the Tribunal has no jurisdiction to
determine whether GMC’s policy is lawful.
33. The Information Commissioner submitted that the Decision Notice had reached the
correct conclusion because disclosure of the requested information would have been
contrary to the data subject’s expectations, contrary to their reasonable expectations
given the changes in the data protection landscape and would have the effect of re-
introducing a blanket policy of indefinite disclosure, causing distress and unfairness
to the doctor concerned. It was submitted that none of these key conclusions were
affected by the clarification that the policy was of keeping MPTS determinations
on GMC’s website for 10 years.
34. The Information Commissioner clarified that she no longer relied on the legitimate
interest identified at paragraph 33 of the Decision Notice (now accepting that GMC
is not in fact funded by the tax payer) but that she did still rely on the legitimate
interest identified at paragraph 34, which is the interest in knowing that doctors are
appropriately licenced and regulated.
35. None of the parties relied on witness evidence. The documentary evidence in the
Tribunal’s bundle included the correspondence between the parties and GMC’s
consultation and finalised policy documents. GMC also included some helpful
screen shots of its website.
Conclusion
36. Firstly, I note that the Appellant’s appeal, as originally pleaded, was based on a
misunderstanding of GMC’s policy. He has fairly acknowledged this (page 187 of
the bundle) and amended his submissions to refer to the ten-year publication period.
His original contention was that GMC’s policy was to delete details of fitness to
practice determinations after only one year, whereas the policy is in fact to delete it
after ten years. The Information Commissioner also seems to have misunderstood
this point. I am grateful to GMC for its clarification.
7
37. I agree with both Respondents that the lawfulness of GMC’s policy is beyond the
statutory remit of this appeal and accordingly I make no decision on the Appellant’s
grounds two and four. The Appellant has, at some length, tried to persuade me that
I cannot determine the lawfulness of the Decision Notice without deciding that
issue, as he submits that the issues are integral. However, it seems to me that even
if I were persuaded to comment on that issue, anything I said would necessarily be
obiter. It is regrettable that the Appellant and GMC have exchanged so many
submissions on matters which have no bearing on the statutorily defined decision I
must take. I have not referred to all their submissions.
38. It does seem to me that a correct understanding of the GMC’s policy is an important
pre-requisite to deciding this appeal, as it is relevant to the expectations of the data
subject concerned. It is unfortunate that the Decision Notice does not reflect a
correct understanding of the policy. However, it does not seem to me that this
misunderstanding, by itself, requires the appeal to be allowed. In determining this
appeal I am required to undertake a full-merits review, which means that I am able
to approach the legal issues afresh in the light of the correct information and thus
cure the factual defects of the Decision Notice.
39. In considering the Appellant’s ground three, I find I share the Appellant’s
discomfort that the Information Commissioner would rely, in undertaking her
quasi-judicial role, on an opinion that she had herself expressed in her regulatory
and advisory role. This approach would appear to risk the introduction of
extraneous considerations into the Decision Notice. However, as noted at paragraph
18 above, this appeal is against the decision reached in the Decision Notice and not
the reasoning adopted in support of that decision. I am not therefore persuaded by
the Appellant’s submission that a material error of law was introduced into the
Decision Notice by its reliance on the Information Commissioner’s previously
expressed view about the GMC’s policy. It seems to me that I can safely make my
fresh decision on this appeal without any reference at all to that consideration.
40. I turn to the Appellant’s ground one. None of the parties have suggested that the
three-stage test is the wrong approach. In considering the elements of that test, it is
necessary to undertake a fact-sensitive analysis, as referred to by UTJ Wikeley in
Cox (see paragraph 15 above). This may have been what the Decision Notice was
intending to refer to in stating that the Appellant did not identify a particular interest
in the disclosure of the requested information. Whilst accepting the Appellant’s
submission that he is not required to evidence the nature of his interest, I also note
here that he has not expressed himself as relying on any context-specific factors.
41. Nevertheless, it seems to me that there is a context-specific factor which ought to
be considered in this case, which is the reference at paragraph 49 of the Decision
Notice (and the Appellant’s submissions thereon at page 229 of the hearing bundle)
to the doctor with whom he is concerned practising in other countries after being
removed from the register in the UK. It seems to me that this is a factor which
should properly be considered under the three-stage test. There may be specific
reasons why a person in another country may legitimately wish to know why a
doctor practicing there has been erased from the register here, so that access to the
8
fitness to practice determination would be a necessary means of meeting that
legitimate interest. Such a factor could, in my view, tip the balance in favour of
disclosure. However, I note that no such case has been made in respect of this
particular doctor.
42. Addressing the first step of the three-stage test, I note the error in the Decision
Notice as to the nature of the legitimate interests identified. I accept the Information
Commissioner’s latest submission that the reference to GMC being publicly funded
was erroneous but that there is nevertheless a legitimate interest in transparency
about the system for ensuring doctors are fit to practice. I agree with all parties that
the legitimate interests test is met in this case and discern no material error in the
Decision Notice in this regard.
43. Turning to the second question of necessity, I agree with the Appellant and the
Information Commissioner that there is a necessity factor here, as accessing the
detailed information about fitness to practice determinations is required to meet that
legitimate interest. I reject GMC’s submission that knowing whether a doctor is
registered or erased is the only information necessary to meet that interest. I discern
no error in the Decision Notice in this regard.
44. It follows that I am now required to move to stage three and apply the balancing
test to consider whether, in all the circumstances, the factors I have found at stages
one and two outweigh the rights of the data subject so as to require disclosure.
45. I turn briefly to deal with the Appellant’s submissions. I conclude that the statutory
provision relied on by the Appellant in relation to the publication of fitness to
practice determinations is permissive as described by GMC and not mandatory of
disclosure, as he suggests. I am not persuaded that the open justice principles he
refers to are influential to the balancing exercise I must undertake. I consider that
the relevant time for considering whether the requested information was already in
the public domain is the date of the public authority’s response to the FOIA request,
as that is the moment when the requester’s appeal rights can be said to crystallise.
I draw an analogy here with the time at which a public interest is to be identified
where a qualified exemption is considered8. I conclude that the requested
information was not obviously in the public domain at the relevant time. I reject
the Appellant’s contention that it is appropriate for me to consider whether any
person may have downloaded and saved it.
46. I conclude that the time for considering the nature of the data subject’s reasonable
expectations is also the date of the public authority’s final response to the
information request. At that time, the doctor with whom we are here concerned
would have seen the details of his fitness to practice determination removed from
the GMC’s website in accordance with its new policy. I am not here concerned
with the correctness of that policy or the effect that any disclosure in this case would
have on that policy, but only with the reasonable expectations of that data subject
8
See paragraphs [61] to [73] Maurizi v IC and CPS [2019] UKUT 252 (AAC)
https://assets.publishing.service.gov.uk/media/5d8dec7ce5274a2fb7408487/GIA_0973_2018-00.pdf.
9
as a result of his reliance on GMC’s public policy. I consider that he had a
reasonable expectation that the requested information would not be disclosed.
47. I have balanced carefully the weight of the legitimate interest and necessity which
I have identified against the particular data subject’s rights. I am satisfied that it
would be distressing to this data subject for the information of the type here
requested to be disclosed. Nevertheless, for the reasons I have alluded to above, it
seems to me that there could well be circumstances in which the balance would tip
in favour of disclosure of such information, for example if there were fresh fitness
to practice concerns in another country which heightened the arguments in favour
of disclosure. However, there has been no suggestion that this context-specific
factor applies here and so I conclude that disclosure would be unfair to the data
subject in the circumstances of this case. I conclude that the legitimate interests and
necessity I have identified should not override this data subject’s rights.
48. For all these reasons, I conclude that the Decision Notice was correct to find that
GMC was right to refuse disclosure of the requested information under s. 40 (2)
FOIA. This is because the information requested was correctly identified as the
personal data of a third party. Further, that s. 40 (3A)(a) FOIA was appropriately
considered to be engaged because disclosure of the information would contravene
Article 5 (1) (a) GDPR. Finally, I find no error of law in the conclusion that the
processing of the personal data requested would not be lawful under Article 6 (1)
(f) GDPR in the circumstances of this case.
49. Although my reasoning has differed from that of the Information Commissioner,
I conclude that there is no error of law or inappropriate exercise of discretion in the
Decision Notice and, accordingly, I now dismiss this appeal.
ALISON MCKENNA DATE: 10 July 2020
CHAMBER PRESIDENT DATE PROMULGATED: 14 July 2020
Corrected Decision DATE : 27 July 2020
10