First-tier Tribunal
General Regulatory Chamber
Information Rights
Appeal Reference: EA/2020/0018 (V – CVP)
Heard remotely by video conference
On 22 March 2021
Before
JUDGE HAZEL OLIVER
GARETH JONES
MALCOM CLARKE
Between
DR SARAH MYHILL
Appellant
and
INFORMATION COMMISSIONER
First Respondent
and
GENERAL MEDICAL COUNCIL
Second Respondent
Appearances:
Appellant – in person
First Respondent – did not attend
Second Respondent – Mr S Kosmin, counsel
Determined at a remote hearing via video (Cloud Video Platform) on 22 March 2021
DECISION
By a majority decision (Judge Hazel Oliver and Gareth Jones), the appeal is dismissed.
Malcom Clarke’s minority decision is explained in the Reasons.
REASONS
Mode of hearing
1. The proceedings were held by video (CVP). All parties joined remotely. The Tribunal was
satisfied that it was fair and just to conduct the hearing in this way. The appellant appeared in
person. The Information Commissioner did not attend the hearing. The Second Respondent,
the General Medical Council (“GMC”) was represented by Mr Kosmin.
Background to Appeal
2. This appeal is against a decision of the Information Commissioner (the “Commissioner”)
dated 17 December 2019 (FS50887698, the “December Decision Notice). It concerns
information sought from the General Medical Council (“GMC”) about the scientific evidence
base for an alleged refusal to investigate a specific complaint.
3. On 28 November 2018 the appellant made the following request for information (the
“Request”):
“1 – If an evidence base [i.e. ‘facts’ and ‘information’] for the GMC refusal to investigate
exists then please show this to me.
2 – If there is no such evidence base, then please state such.”
4. The GMC did not initially deal with the Request under the Freedom of Information Act 2000
(“FOIA”). Instead, they dealt with it as part of correspondence about the appellant’s ongoing
concerns. The appellant complained about this to the Commissioner. Decision Notice
FS50831407 from the Commissioner (the “September Decision Notice”) found that this should
have been dealt with by the GMC as a FOIA request and required the GMC to provide a
response to the appellant under FOIA.
5. The GMC issued a response to the appellant under FOIA on 24 October 2019. It refused
to confirm or deny whether it held the requested information as it was third party personal data,
under sections 40(5A) and 40(5B)(a)(i) FOIA.
6. The appellant complained to the Commissioner on 25 October 2019. The Commissioner
dealt with the matter without requiring an internal review due to the previous delays and
likelihood the internal review would make no material difference to the GMC’s decision. She
issued her Decision Notice on 17 December 2019 and decided that the GMC was entitled to
refuse to confirm or deny whether the requested information was held in accordance with
section 40(5B)(a)(i) FOIA. The Commissioner found that:
a. The requested information if held would relate to a complaint to the GMC about third
parties. Confirming or denying that the information was held would disclose whether
the GMC had received a complaint about these third parties. This would disclose third
party personal data.
b. Applying the processing condition in Article 6(1)(f) GDPR, the Commissioner found
that there is a legitimate interest in confirmation or denial given the general duty of
openness and transparency. She also noted that the appellant had her own legitimate
interests and considered it had wider societal implications. The Commissioner was
not aware of any less intrusive means by which the legitimate interests identified could
be met.
c. However, there was insufficient legitimate interest to outweigh the data subjects’
interests or fundamental rights and freedoms, and so confirming or denying whether
the information was held would not be lawful. The GMC has a clear policy of not
disclosing the existence or details of complaints if they do not cross the threshold of
investigation, meaning that the data subjects have a reasonable and fair expectation
that this type of information will remain private and confidential. Confirmation or denial
that the requested information is held would cause distress and upset and constitute
an unwarranted intrusion into their rights of privacy.
The Appeal
7. The appellant appealed against the Commissioner’s decision on 8 June 2019. The
grounds given for appeal can be summarised as:
a. There are no personal information issues, as she is simply asking for a scientific
evidence base used for a GMC decision.
b. The GMC incorrectly appealed the September Decision Notice through the
Commissioner instead of the Tribunal, and the December Decision Notice is
inconsistent with the first one.
c. The information asked for in the Request should be made available for public scrutiny
because the underlying issues pass the public interest test.
8. The Commissioner’s response maintains that she was correct to uphold the GMC’s
decision:
a. Confirmation about whether an evidence base exists in relation to an investigation into
“Doctor X” will be information relating to Doctor X. Even if a person with no prior
knowledge could not identity Doctor X from the information, a likely recipient of the
data could do so by applying their knowledge of the context. Therefore, confirmation
or denial constitutes the personal data of the relevant doctors.
b. The legitimate interest in disclosure is very weak in this case. The information that
would be imparted by a confirmation or denial is whether a complaint has been made.
There is little public interest in such a disclosure if an underlying allegation has not
progressed beyond the initial stage.
c. The relevant interest (transparency) can only be served by disclosure of the
information. However, this weak public interest is overridden by the data subjects’
interests. Disclosure of whether a complaint has been made is of minimal public
interest but risks causing real distress and upset and reputational harm to the doctors
concerned. Doctors have a reasonable expectation that complaints which do not pass
an initial sift will not be published, particularly in light of the GMC’s published disclosure
policy.
d. The fact the appellant knows the personal data, and has received correspondence
from the GMC, is different from disclosure under FOIA to the world at large.
e. For the same reasons, it would not be fair or transparent to confirm or deny whether
the information is held.
f. The September Decision Notice does not contradict the December Decision Notice.
In the September Decision Notice, the Commissioner found that the Request was a
valid one under FOIA and the GMC should reply under FOIA. The GMC did then reply
under FOIA by refusing to confirm or deny whether it held the information sought. The
two Decision Notices concern different issues.
9. The GMC has also submitted a response which maintains its reliance on section
40(5B)(a)(i) FOIA.
a. The GMC’s Publication and Disclosure Policy (published in February 2018) states that
the fact a doctor is the subject of an investigation will not be disclosed unless a warning
is issued, undertakings are agreed or a hearing takes place (except where an interim
order to restrict practice is imposed). This approach had been followed for a number
of years prior to publication of this policy.
b. Confirming or denying whether the requested information is held would reveal
personal data about third parties - it would confirm that individuals identified in the
appellant’s correspondence with the GMC had been the subject of a complaint. The
fact the appellant already knows their identity, or has made this information public,
does not answer this issue. Disclosure under FOIA is to the world at large, and the
privacy rights of data subjects cannot be materially reduced by the fact the appellant
had chosen to put information into the public domain.
c. The appellant has misunderstood the effect of the September Decision Notice. The
GMC’s refusal to confirm or deny that information was held was issued in order to
comply with the September Decision Notice.
d. The legitimate interest in disclosure of the information is limited to general
considerations of transparency and accountability. This is insufficient to outweigh the
data subjects’ rights. Disclosure would breach the GMC’s published policy and so
would breach the data subjects’ reasonable and fair expectations as to how their data
would be processed.
10. The appellant provided a reply which asserts that the Commissioner dealt with this matter
incorrectly as a data protection issue rather than under FOIA, and the Commissioner was
misled by the GMC.
Applicable law
11. The relevant provisions of FOIA are as follows.
1 General right of access to information held by public authorities.
(1) Any person making a request for information to a public authority is entitled—
(a) to be informed in writing by the public authority whether it holds
information of the description specified in the request, and
(b) if that is the case, to have that information communicated to him.
……
40 Personal information.
(1) Any information to which a request for information relates is exempt
information if it constitutes personal data of which the applicant is the data
subject.
(2) Any information to which a request for information relates is also exempt
information if –
(a) it constitutes personal data which do not fall within subsection (1), and
(b) the first, second or third condition below is satisfied.
(3A) The first condition is that the disclosure of the information to a member of the
public otherwise than under this Act would contravene –
(a) any of the data protection principles, or
(b) would do so if the exemptions in section 24(1) of the Data Protection Act
2018 (manual unstructured data held by public authorities) were
disregarded.
…….
(5A) The duty to confirm or deny does not arise in relation to information which is
(or if it were held by the public authority would be) exempt information by virtue
of subsection (1).
(5B) The duty to confirm or deny does not arise in relation to other information if or
to the extent that any of the following applies –
(a) Giving a member of the public the confirmation or denial that would have
to be given to comply with section 1(1)(a) –
(i) would (apart from this Act) contravene any of the data protection
principles, or
(ii) would do so if the exemptions in section 24(1) of the Data
Protection Act 2018 (manual unstructured data held by public
authorities) were disregarded.
.…..
58 Determination of appeals.
(1) If on an appeal under section 57 the Tribunal considers—
(a) that the notice against which the appeal is brought is not in accordance
with the law, or
(b) to the extent that the notice involved an exercise of discretion by the
Commissioner, that he ought to have exercised his discretion
differently,
the Tribunal shall allow the appeal or substitute such other notice as could have
been served by the Commissioner; and in any other case the Tribunal shall
dismiss the appeal.
(2) On such an appeal, the Tribunal may review any finding of fact on which the
notice in question was based.
12. Section 3(2) of the Data Protection Act 2018 (“DPA”) defines “personal data” as “any
information relating to an identified or identifiable living individual”. The “processing” of such
information includes “disclosure by transmission, dissemination or otherwise making available”
(s.3(4)(d) DPA), and so includes disclosure under FOIA.
13. The data protection principles are those set out in Article 5(1) of the General Data
Protection Regulation (“GDPR”), and section 34(1) DPA. Section 3(2) DPA defines “personal
data” as “any information relating to an identified or identifiable living individual”. The first data
protection principle under Article 5(1)(a) GDPR provides that, “Personal data shall be
processed lawfully, fairly and in a transparent manner in relation to the data subject”.
14. In order to be lawful, processing must meet one of the conditions in Article 6(1) GDPR.
The relevant condition in this case is condition 6(1)(f) GDPR – “processing is necessary for the
purposes of the legitimate interests pursued by the controller or by a third party, except where
such interests are overridden by the interests or fundamental rights and freedoms of the data
subject which require protection of personal data, in particular where the data subject is a child.”
15. This involves consideration of three questions (as set out by Lady Hale DP in South
Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55):
(i) Is the data controller or third party or parties to whom the data are disclosed pursuing
a legitimate interest or interests?
(ii) Is the processing involved necessary for the purposes of those interests?
(iii) Is the processing unwarranted in this case by reason of prejudice to the rights and
freedoms or legitimate interests of the data subject?
The wording of question (iii) is taken from the Data Protection Act 1998, which is now replaced
by the DPA and GDPR. This should now reflect the words used in the GDPR – whether such
interests are overridden by the interests or fundamental rights and freedoms of the data subject
which require protection of personal data.
16. In Goldsmith International Business School v Information Commissioner and the
Home Office [2014] UKUT 563 (AAC), Upper Tribunal Judge Wikeley provided guidance on
the application of these tests. “Necessity” carries its ordinary English meaning, being more than
desirable but less than indispensable or absolute necessity. The test is one of “reasonable
necessity”, reflecting European jurisprudence on proportionality. This involves the
consideration of alternative measures, so the measure must be the least restrictive means of
achieving the legitimate aim in question.
Issues and Evidence
17. The overall issue in this case is whether the GMC was entitled to rely on section
40(5B)(a)(i) FOIA in order to refuse to confirm or deny whether it held the information in the
Request. This involves the following issues:
a. Would confirming or denying that the information is held reveal personal data about
third parties?
b. Is the data controller or third party or parties to whom the data are disclosed pursuing
a legitimate interest or interests?
c. Is disclosure (through confirmation or denial) necessary for the purposes of those
interests?
d. Are such interests overridden by the interests or fundamental rights and freedoms of
the data subjects which require the protection of personal data?
18. We had an agreed bundle of documents. We heard detailed oral submissions from the
appellant and Mr Kosmin, and we thank both parties for their clear presentations. Mr Kosmin
also referred us to various previous First-Tier Tribunal decisions involving similar requests for
information from the GMC. We have taken account of these decisions but are not bound to
follow them.
19. We have redacted in this decision any specific details which might enable the data subjects
to be identified.
Discussion and Conclusions
20. In accordance with section 58 FOIA, our role is to consider whether the Commissioner’s
Decision Notice was in accordance with the law. As set out in section 58(2), we may review
any finding of fact on which the notice in question was based. This means that we can review
all of the evidence provided to us and make our own decision as to whether or not the GMC
was entitled to refuse to provide the requested information. Our role does not involve
addressing detailed criticisms of the Commissioner’s investigation. We may or may not agree
with the Commissioner’s conclusions.
Procedural issues
21. We start with the procedural issues raised by the appellant. She complains that the
process has been unfair and a breach of the normal procedure. She says that the GMC failed
to comply with the September Decision Notice, and instead raised new data protection issues.
The GMC then canvassed the Commissioner through the “back door” in order to obtain the
December Decision Notice, which contradicts the earlier decision. This was done without
consultation with the appellant. The correct course of action would have been to appeal the
September Decision Notice to the Tribunal.
22. The GMC says that the appellant has misunderstood the process, which followed normal
procedure. Having considered the chain of events and relevant documents, we find that there
was no breach of procedure or other unfairness of process in this case.
23. The September Decision Notice required the GMC to provide a response to the appellant
under FOIA. This was because the GMC had failed to deal with the appellant’s correspondence
as a FOIA request. Importantly, it did not require the GMC to actually provide the requested
information. The GMC did then provide a response under FOIA. This response was a refusal
to confirm or deny if the information was held. They relied on one of the exemptions under
FOIA which relates to data protection. Therefore, the GMC did do what was required by the
September Decision Notice – they provided a response to the appellant under FOIA.
24. The appellant complained about this response to the Commissioner on 25 October 2019.
The Commissioner investigated this new complaint and provided an outcome in the December
Decision Notice. This investigation was not instigated by the GMC through the back door. It
was triggered by the appellant’s complaint. As is usual with complaints, the Commissioner
asked for further information from the public authority before making a decision (email of 5
November 2019, page D943 in the bundle). The December Decision Notice was not
inconsistent with the September Decision Notice, because the earlier decision had not required
the GMC to provide the requested information. The GMC had provided a response under FOIA
which relied on a specific exemption. The Commissioner agreed that the exemption had been
applied correctly.
25. The appellant complains that there was no consultation with her before the decision was
issued. However, this is often how the Commissioner will deal with a complaint. She will
consider the complaint, ask the public authority for information, and issue a decision. It is not
a breach of proper procedure and does not invalidate the Commissioner’s decision.
Substantive issues
26. Would confirming or denying that the information is held reveal personal data about
third parties? The requested information clearly contains personal data because it relates to
a specific complaint. Confirming or denying whether the GMC holds an evidence base relating
to a particular investigation will reveal whether there was a complaint about specific doctors.
27. The appellant rightly says that she was not asking for any personal information. But,
providing the information she was asking for would nevertheless reveal personal data. The
GMC cannot answer the appellant’s question about a specific complaint without revealing
personal data. Although the wording of the Request itself does not reveal or ask for personal
data, the Request must be read in the context of earlier correspondence between the parties
which would involve identifying the individuals involved. This correspondence clearly names
individual doctors, and also the work with which they were involved, which could also be used
to identify them. The Request itself forms part of a longer email which refers to the appellant’s
complaint and concerns about how it was dealt with. As put in the Commissioner’s response,
confirmation about whether an evidence base exists in relation to a potential investigation into
“Doctor X” will be information relating to Doctor X.
28. The question for the Tribunal is whether the GMC can refuse to confirm or deny that this
information is held. The duty to confirm or deny does not apply if doing so would contravene
any of the data protection principles. These principles require the doctors’ personal data to be
processed lawfully, fairly and transparently.
29. The GMC has provided some background to its complaints and investigations process.
The GMC is the independent regulator for doctors in the UK. It has a statutory function to
investigate complaints that a registered person’s fitness to practise is impaired. An
investigation into a complaint against a medical practitioner starts with an initial decision by the
Registrar as to whether there should be a formal investigation. If not, the matter does not
proceed any further. If there is to be a formal investigation, the Registrar refers the complaint
to two Case Examiners to decide on what action should be taken. The Case Examiners may
refer the matter to the Medical Practitioners Tribunal Service, agree undertakings from the
practitioner, issue a warning, or close it with no action. A complainant who is dissatisfied with
a decision not to progress a complaint can seek review by the Registrar under rule 12 of the
relevant rules. The Registrar can review the decision if there is reason to believe it is materially
flawed or there is new information which may have led to a different decision, or if other specific
grounds apply (a review is necessary for the protection of the public, to prevent injustice to the
practitioner, or otherwise necessary in the public interest). A complainant can also pursue a
judicial review.
30. In order for processing of the doctor’s personal data to be lawful, one of the conditions in
the GDPR must apply. The relevant condition here is 6(1)(f) GDPR. We apply the facts to the
three questions relevant to this condition as follows.
31. Is the data controller or third party or parties to whom the data are disclosed
pursuing a legitimate interest or interests? The parties agree that the appellant is pursuing
legitimate interests.
32. The appellant argues that the underlying issues behind her request are in the public
interest. Her complaint makes serious allegations about fraud, misuse of public money, and
harm to patients, which she says the GMC ought to have addressed by investigating further
and conducting fitness to practice hearings. She says she is challenging the GMC’s decisions
in the public interest.
33. The Commissioner found in her Decision Notice that the appellant was pursuing legitimate
interests - both a general interest in openness and transparency, and the interests involved in
her underlying issue which have wider societal implications. The GMC also accepts that the
appellant is pursuing legitimate interests, although says that these are limited to general
considerations of transparency and accountability.
34. We agree that the appellant is pursuing legitimate interests by making her request for
information. There is a general public interest in openness, transparency and accountability
arising from information about the GMC’s complaints process and decision-making. There is
also a more specific public interest in the serious matters raised by the appellant in relation to
her specific complaint, and how the GMC dealt with that complaint. Unlike in many cases about
complaints to the GMC, the appellant is not asking directly for confirmation or denial as to
whether information about named doctors is held by the GMC. The appellant knows this
information already. However, this information will be revealed to the word at large if the GMC
answers her actual request under FOIA. There are legitimate interests behind the Request.
Therefore, disclosure of the doctors’ personal data as a result of confirming or denying whether
information is held would further these legitimate interests.
35. Is disclosure (through confirmation or denial) necessary for these legitimate
interests? We have assessed this on the basis of the tests set out above, by considering
reasonable necessity and whether there are less restrictive means of achieving the legitimate
aim in question. General openness, transparency and accountability cannot obviously be
achieved by means other than disclosure to the world at large under FOIA. It is more
questionable whether there are less restrictive means of addressing the concerns about how
the GMC has dealt with the appellant’s specific complaint – given the availability of review by
the Registrar and judicial review, and the limited information that is provided by confirmation or
denial. However, in the circumstances we accept that confirmation or denial as to whether an
evidence base is held is reasonably necessary to the public interest in understanding how the
appellant’s complaint was dealt with by the GMC.
36. Are those interests overridden by the interests or fundamental rights and freedoms
of the data subjects which require protection of personal data? It is clear that doctors
have a reasonable expectation that the fact a complaint has been made against them will not
be disclosed to the world at large by the GMC. We have seen the GMC’s published publication
and disclosure policy. In relation to complaints and investigations, this policy states, “The fact
that a doctor is the subject of an investigation will not be routinely disclosed to general enquirers
(apart from current or new employers/responsible officers) or the media unless and until a
warning is issued, undertakings are agreed or a hearing takes place. The exception to this is
where it is necessary for the MPTS to impose an interim order to restrict the doctor’s practice
as a precautionary measure.” This policy is consistently followed by the GMC in relation to
FOIA requests.
37. The majority of the Tribunal finds that these interests are overridden by the doctors’ data
protection rights, and so confirmation or denial would not be lawful under the DPA and GDPR.
Confirming or denying whether information is held about a complaint would cause the doctors
distress and upset and constitute a serious intrusion on their privacy. This would be a clear
breach of their reasonable expectations of privacy, which arise from the GMC’s published policy.
Publication of the fact that a complaint has been made about a named doctor is very likely to
cause damage to their professional reputation. The GMC’s publications policy strikes a balance
between transparency where action has been taken in relation to a doctor’s fitness to practice
and preserving privacy where a complaint has not resulted in such action. Disclosure of the
fact a complaint has been made about a doctor reveals little, if anything, about actual fitness to
practice, but is very likely to cause damage and distress to the individual doctor.
38. We are aware that there has been some public discussion of the underlying issues of
concern to the appellant which has potentially disclosed the identity of the doctors involved,
both through her own activities and through debates in Parliament. Mr Kosmin submitted that
this is likely to increase the distress as the issue is already in the public eye. We do not agree
– if anything, this may reduce the damage to professional reputation that would be caused by
a confirmation that a complaint had been made to the GMC, as there has been professional
and political discussion of the underlying issues. Nevertheless, the doctors still have a
reasonable expectation that the GMC will preserve their privacy in accordance with their
published policy. The fact that the appellant has chosen to make some matters public should
not reduce the privacy rights of the doctors, or their reasonable expectations that the GMC will
comply with its own policy and keep the information confidential.
39. The Commissioner and the GMC have submitted that the appellant’s legitimate interests
in disclosure are very weak, and so easily outweighed by the doctors’ privacy rights. We do
not agree and find that the issue is more finely balanced. As explained, there are various
legitimate interests in the information requested by the appellant, which is the evidence base
for not proceeding to an investigation in response to a complaint to the GMC. This issue is
potentially of public importance.
40. However, the confirmation or denial by the GMC that it holds information of the description
specified in the Request will only further these interests to a limited extent. The appellant
herself provided a set of detailed evidence to the GMC. She has made wide-ranging allegations
about fraud, misuse of public money, and alleged harm to thousands of patients. The GMC
sent a ten-page letter to the appellant which explained in detail the reasons for not taking the
matter any further. The appellant had the options of a review by the Registrar and judicial
review in order to challenge the GMC’s decision. FOIA is not a substitute for these processes,
which are designed to allow scrutiny of the GMC’s decision-making where needed.
Confirmation or denial that the GMC holds evidence for its decision not to proceed to an
investigation will only further the identified legitimate interests in a limited way – particularly
because the appellant herself had provided detailed evidence to the GMC. But, by doing so,
the GMC would be confirming or denying that it holds information about complaints about
specific doctors. This will clearly breach the privacy rights of those doctors in a way likely to
cause distress and reputational damage.
41. Having considered the matter carefully, the majority of the Tribunal therefore finds that the
legitimate interests in disclosure (through confirmation or denial) are overridden by the privacy
rights of the doctors which require protection of personal data. The appellant submitted that
the GMC was using micro-arguments about data protection to trump macro-arguments about
alleged fraud and patient safety. Our role is to balance the legitimate interests in confirmation
or denial that the requested information is held against the privacy rights of the doctors. Having
done so, we find that the balance weighs in favour of the privacy rights. This is not to diminish
the importance of the underlying issues of concern behind the appellant’s complaint to the GMC
(although we are making no finding on whether these allegations are correct or not). However,
for the reasons explained above, confirmation or denial would clearly breach the doctors’
privacy rights while furthering the legitimate interests behind the Request in only a limited way.
42. Malcolm Clarke's minority view is as follows. I completely concur with the conclusions of
my colleagues on the procedural issues (Paras 21 to 25) and on the first three tests of the
substantive issues (paras 26 to 35). However, on balance (and I agree with the view in
paragraph 39 that it is a balanced judgement) I reach a different conclusion on the final limb
(Paras 36 to 41) for the following reasons.
43. The previous cases cited (on two of which I sat), involving requests to the GMC for
information relating to complaints against doctors, involve complaints, if they exist, about
treatment or advice provided by those doctors to individual named patients. This case is
different in that it relates to complaints to the GMC, if they exist, about a published clinical
research trial which informed national NICE guidelines.
44. Evidence given to us showed that the conduct and validity, and therefore the findings, of
this trial became the subject of extensive dispute in professional journals and gave rise to two
debates in Parliament, in at least one of which one of the doctors was named. Dr Myhill gave
evidence, which was not contested by the GMC, that as a result of these debates, the NICE
guidelines were altered.
45. We have neither the jurisdiction nor the expertise to reach any conclusions on the clinical
issues. However, I conclude that Dr Myhill's legitimate interest in seeking this information, if it
exists, as a practising doctor with patients, who has a deep professional interest in ensuring
that national recommended treatments in this area of medicine are evidence-based, is a very
strong one.
46. I agree (i) that confirmation or denial that the information is held would reveal personal
information about the doctors involved and (ii) that the stance of the GMC to neither confirm
nor deny whether information is held is entirely correct in the more usual type of case where a
complaint, if it exists, against a doctor about individual treatment is not taken to the next stage.
However, in this case, I think:
a. Dr. Myhill’s legitimate interest in knowing whether the evidence she requests is held
by the GMC, is a very strong one in the context of the wider professional, parliamentary,
and public interest in the history of treatment guidance in this area of medicine.
b. Those professional and political debates will, or should have, altered the doctors'
reasonable expectations of privacy.
47. I therefore conclude that, in this case, the processing of personal data caused by
confirmation or denial that the requested information exists would be lawful, fair and transparent,
and that, applying Article 6(1)(f) of GDPR, Dr Myhill's legitimate interests are not overridden by
the rights and freedoms of the data subjects.
48. For the avoidance of doubt, I make no assumptions about whether information within the
scope of the request is held by the GMC or, if it is, whether any exemptions are engaged.
49. The majority decision is that disclosure of the doctors’ personal data would not be lawful
and so would breach one of the data protection principles. The GMC is entitled to refuse to
confirm or deny the existence of the requested information under section 40(5B)(a)(i) FOIA. By
a majority decision the appeal is dismissed.
Signed: Hazel Oliver
Judge of the First-tier Tribunal
Date: 6 April 2021
Promulgation Date: 7 April 2021