Case Reference: EA/2020/0335
Neutral Citation number: [2023] UKFTT 00076 (GRC)
First-tier Tribunal
General Regulatory Chamber
Information Rights
Heard: Paper determination
Heard on: 5 August 2021
Decision given on: 4 October 2022
Promulgated on: 25 January 2023
Before
TRIBUNAL JUDGE LYNN GRIFFIN
TRIBUNAL MEMBER ANNE CHAFER
TRIBUNAL MEMBER ALISON LOWTON
Between
GIOVANNI MARCHESELLI
Appellant
and
(1) THE INFORMATION COMMISSIONER
(2) THE GENERAL MEDICAL COUNCIL
Respondents
Decision: The appeal is Dismissed
REASONS
The factual background to the appeal
1. In September 2019 the appellant raised his concern with the General Medical Council
(GMC) about the fitness to practise of a doctor alleging that he and his family had
been harmed by the doctor’s actions which he said had brought the profession into
© CROWN COPYRIGHT 2022
disrepute. In November 2019 he raised further allegations with the GMC about a
second doctor. The GMC decided not to open an investigation into the issues raised
by the appellant about either doctor. Those decisions were notified to him on 9
December 2019 and the appellant requested a review of the GMC’s decisions on 23
December 2019 which was referred to the GMC’s review team in accordance with the
GMC Rules. In due it was determined after review that a fresh decision was not
necessary and the original decision to close the matter would stand. This decision is
not about resolving those allegations which were considered by the GMC and
responded to within their responsibility as the regulator of medical practitioners in
the UK. Nor is this decision about the appellant’s dissatisfaction with the GMC’s
decision and its fitness to practise processes or the general system of regulating
doctors.
2. On 23 February 2020 the appellant wrote to the GMC to request information under
the Freedom of Information Act 2000 (FOIA). This decision is only about that request
and whether the information requested by the appellant should be disclosed to him.
3. The information requested concerned one of the doctors about whom the appellant
had complained in September 2019, that doctor is not named in this decision, which
will indicate where their name would have been in any quoted material1. The
information request read as follows
“Information request RE: [name and GMC no of Dr redacted]
Please provide the following information in respect of this doctor which is not on the
medical register:
1. Names of Designated body and / or Annual Appraisal Doctor / Responsible
officer for last five years: 2019, 2018, 2017, 2016, 2015
2. Year or date of last revalidation
3. Year or date of next revalidation
General queries:
Can a doctor acquire practising privileges at a designated body (non NHS) and then
not actually work there but run his/her own private practice instead?
Would this be regarded as having a 'connection'?
Would the designated body where there are only practising privileges but not any
employment or contracts be regarded as having an appropriate connection for
appraisal and/or revalidation requirements?
Under what circumstances might a psychiatrist have a responsible officer who is not
1. See order made under rule 14 at the end of this decision
2
also a psychiatrist?”
4. The GMC response was sent on 24 March 2020. As regards questions 1 – 3 in the
request the GMC told the appellant that they were withholding the requested
information under section 40(2) FOIA as it was the doctor’s personal data. The GMC
went on to give an explanation as regards the appellant’s general queries. The GMC
asked the appellant to clarify his queries as they indicated that the questions may be
based on misunderstandings. Those general queries were the subject of further
correspondence but do not form part of this appeal which is concerned with the
information requested in questions 1-3.
5. Revalidation as referred to in questions 2 and 3 of the request, is the process by which
the GMC confirms the continuation of a doctor’s licence to practise in the UK.
Revalidation is mandatory for doctors who wish to retain their licence to practise.
Revalidation involves a yearly appraisal process which will often involve a
“Designated Body” and a “Responsible Officer”. A Designated Body is an
organisation that assists a doctor with their appraisal and revalidation process; the
Responsible Officer at the relevant Designated Body makes the recommendation for
the revalidation. If a doctor has a Responsible Officer, they will make a revalidation
recommendation to the GMC every five years. Revalidation can also be undertaken
in alternative ways, for example through the GMC’s approval process, or via an
alternative “suitable person”. Although a doctor may work in more than one place
at a given time a doctor can only be attached to one Designated Body at a given time.
This does not necessarily indicate that their Designated Body is their sole employer,
or their employer at all. It does not even necessarily indicate their physical place of
work: for example, many locum agencies are Designated Bodies. Where a doctor has
multiple employers, their Designated Body is determined by application of the
Medical Profession (Responsible Officer) Regulations 2010 (“the 2010 Regulations”).
6. The appellant wrote back to the GMC on 2 April 2020 disputing that the information
requested in questions 2 and 3 of the request would be personal data and stated that
as the information within question 1 had been in the public domain previously the
GMC were wrong to rely on s40(2) in that regard.
7. The GMC not only publishes guidance about the revalidation process but also
publishes specific categories of information about doctors and their registrations in
the Medical Register which is available to the public on the GMC’s website. There is
a publication policy which sets out what information will be published about each
registered doctor, this includes the current status of their licence to practise,
confirmation of whether they are subject to revalidation, and if so their current
Designated Body and Responsible Officer.
3
8. The GMC does not publish information once it is no longer current. Thus at the time
of the request on 23 February 2020 the information requested in question one of the
request was not published.
9. The GMC has never published the year or dates of doctors’ revalidations as sought
in parts 2-3 of the request, nor has it published the names of appraisers other than
Responsible Officers as it sees no need to do so, as the publication of such details
about a doctor’s career would not assist the public in understanding or scrutinising
either the GMC’s discharge of its regulatory functions or the doctor’s fitness to
practise and historic data may only provide a partial picture of the doctor’s recent
career history. The GMC has a process for handling complaints and comprehensive
fitness to practise procedures that operate within a statutory framework but the
information requested by the appellant is not relevant to that regime as the public
does not need such information should they wish to make a complaint about a doctor
or to understand the GMC’s discharge of its statutory function.
10. The GMC publishes specific categories of information about doctors and their
registrations in the Medical Register, available on the GMC’s website. Those
categories of information have been selected by the GMC in order to strike the correct
and proportionate balance between transparency in respect of doctors’ registrations
(and thus this aspect of the GMC’s regulatory functions) and doctors’ rights to
privacy. The GMC’s approach is detailed in its Publication and Disclosure Policy.
That policy is intended to inform doctors’ reasonable expectations as to what
information about them will and will not be made publicly available. That policy was
amended in 2016, following a consultation exercise, which was also published.
The decision notice in this case
11. The appellant requested an internal review on 8 April 2020 noting that the GMC
position was that information that is no longer current reacquires a private status but
that in his view this was contrary to the revalidation processes’ stated aims of
ensuring that doctors are “safe” to practise and reduces transparency.
12. The result of the internal review was notified to the appellant on 1 July 2020. The
GMC maintained its original position that the information requested is the personal
data of the named doctor.
13. The appellant complained to the Information Commissioner on 21 July 2020. Having
conducted an initial review the Commissioner indicated that it was the
Commissioner’s initial assessment that the exemption provided by s40(2) was
properly engaged and invited the appellant to withdraw his complaint. However, he
did not withdraw the complaint and requested a formal decision notice which was
4
issued on 26 October 2020, reference IC-47549-W6H0. That decision notice concluded
that the GMC is entitled to withhold the information under s40(2) by way of
s40(3A)(a).
Legal Framework
14. Section 1 FOIA sets out the duty on a public authority to communicate information
requested of it as follows
“(1) Any person making a request for information to a public authority is entitled—
(a) to be informed in writing by the public authority whether it holds
information of the description specified in the request, and
(b) if that is the case, to have that information communicated to him.”
It is to be noted that disclosure made pursuant to s1 FOIA is regarded as made to the
world at large and not simply to the requestor.
15. However, the duty in section 1 does not apply to “exempt information” by virtue of
section 2:
“(2) In respect of any information which is exempt information by virtue of any provision of
Part II, section 1(1)(b) does not apply if or to the extent that—
(a) the information is exempt information by virtue of a provision conferring absolute
exemption, or
(b) in all the circumstances of the case, the public interest in maintaining the exemption
outweighs the public interest in disclosing the information.
(3) For the purposes of this section, the following provisions of Part II (and no others) are to be
regarded as conferring absolute exemption—
…
(fa) section 40(2) so far as relating to cases where the first condition referred to in that
subsection is satisfied,”
16. In this case the relevant provision conferring an exemption in Part II of FOIA is
section 402 which at the time of the request stated as relevant
“(2) Any information to which a request for information relates is also exempt information if—
(a) it constitutes personal data which does not fall within subsection (1), and
(b) the first, second or third condition below is satisfied.
2
This is the relevant version of this provision applicable to the decision notice but which has since been amended upon
the end of the ‘Brexit’ transition period.
5
(3A) The first condition is that the disclosure of the information to a member of the public
otherwise than under this Act—
(a) would contravene any of the data protection principles,
…
(3B) The second condition is that the disclosure of the information to a member of the public
otherwise than under this Act would contravene Article 21 of the GDPR (general processing:
right to object to processing).
(4A) The third condition is that—
(a) on a request under Article 15(1) of the GDPR (general processing: right of access by
the data subject) for access to personal data, the information would be withheld in reliance
on provision made by or under section 15, 16 or 26 of, or Schedule 2, 3 or 4 to, the Data
Protection Act 2018, or
(b) on a request under section 45(1)(b) of that Act (law enforcement processing: right of
access by the data subject), the information would be withheld in reliance on subsection
(4) of that section.”
17. Personal data is defined in the Data Protection Act 2018 within s3(2) which reads
““Personal data” means any information relating to an identified or identifiable living
individual”
18. The first data protection principle is set out in Article 5(1)(a) of the GDPR, as follows
“Personal data shall be processed lawfully, fairly and in a transparent manner in relation to
the data subject.”
19. “Fairness” entails balancing the reasonable expectations of the data subject and the
damage or distress that disclosure is likely to cause against any countervailing
justification for disclosure.
20. In order for processing to be lawful, one of the reasons listed in Article 6(1) of the
GDPR must apply to the processing. The only basis that is potentially applicable in
this case is Article 6(1)(f), which sets out that
“..processing is necessary for the purposes of the legitimate interests pursued by the controller
or by a third party, except where such interests are overridden by the interests or fundamental
rights and freedoms of the data subject which require protection of personal data…”
21. There is a three-part test that must be satisfied if Article 6(1)(f) is to be regarded as
the lawful basis for processing the data. That three part test is as follows
6
a. Legitimate interest test: whether a legitimate interest is being pursued in
the request for information;
b. Necessity test: whether disclosure of the information is necessary to meet
the legitimate interest in question;
c. Balancing test: whether the above interests override the legitimate
interest(s) or fundamental rights and freedoms of the data subject.
22. Guidance has been given in caselaw as to the approach that is to be taken to the
application of the three part test and although that arose under a previous provision
that is equivalent to Article 6(1)(f), and thus the rulings of the Upper Tribunal remain
relevant and binding on the First Tier Tribunal.
23. The primary case to be considered is Goldsmith International Business School v
Information Commissioner and Home Office [2014] UKUT 563 (AAC). A “reasonable
expectation of privacy” is central to the engagement of an individual’s rights under
Article 8 of the European Convention on Human Rights (“ECHR”). The analysis of
fairness and of condition 6(1)(f) will therefore be applied in accordance with ECHR
principles of proportionality meaning that disclosure can only take place if it would
be reasonably necessary for the purposes of a “pressing social need” and it must be
the least intrusive way of achieving that aim.
24. We were also referred the decision of the Upper Tribunal in Information
Commissioner v Rodriguez-Noza and Foster [2015] UKUT 449 (AAC) which applied
the dicta of the courts and states
“The first stage is to consider whether the processing is necessary for the purposes of legitimate
interests pursued by the data controller or by the third party or parties to whom the data
would be disclosed. If not, it is not necessary to proceed to the other stages. That is what I
decided in Farrand at [29].
The second stage only arises if the consideration passes the first stage. It is then necessary to
identify the rights and freedoms or legitimate interests of the data subject. If there are none, it
is not necessary to proceed to the third stage.
The third stage only arises if the consideration passes the first and second stages. It is then
necessary to consider whether the processing is unwarranted, or overridden, in any particular
case by reason of prejudice to the data subject’s rights, freedoms or legitimate interests.”
25. In DB v GMC [2018] EWCA Civ 14978, the Court of Appeal confirmed that data
controllers are best placed to make decisions about how that balance should be struck
in their particular context. That is not to say that the Tribunal is bound by the decision
of the data controller but that weight to the GMC’s assessment of how the balance is
struck and a good reason would be needed to overturn that assessment as regards
the disclosure of personal data.
7
The appeal and the submissions of the parties
26. The appellant lodged his notice of appeal against the decision notice on 20 November
2020. The remedy sought by the appellant was the disclosure of the requested
information.
27. The appellant requested a paper determination of his appeal and no other party
requested an oral hearing. Given the issues and receipt of written submissions from
all three parties that set out and developed their respective cases and response to
each others points, we decided it was fair and just to determine the appeal on the
papers.
28. The grounds of appeal run to just over 4 pages and was accurately summarised as
follows by the first respondent in their response into four key points
“1) When assessing the legitimate interests element, the DN erroneously discounts
information on the basis that it refers to a ‘second doctor’. The Appellant explains that
there is only one doctor at issue, which is the named doctor.
2) When considering the necessity element, allowing the revalidation history of the named
doctor to be withheld means that the revalidation history of all doctors could be withheld.
This means that the Appellant’s “more general concerns cannot ever be addressed”. The
Appellant’s view is that this information should be available in respect of all doctors.
3) In respect of the necessity element, the public needs to have access to doctors’ history
of connection to various Designated Bodies and Responsible Officers because this can
reveal safety issues. In addition, the Appellant’s experience shows that the entries in the
publicly available information may be inaccurate.
4) When considering the balance of interests test, the Commissioner incorrectly records
the detail of some of the Medical Profession (Responsible Officer) Regulations 2010. In
addition, Sir Keith Pearson has provided a review that highlights some weaknesses in the
current revalidation process. All of this indicates that a doctor’s connection and
disconnection history is a matter of public concern. The public needs this information in
order to have confidence in the system. Disclosure of this information will add to patient
safety. Any distress to the doctor would be outweighed by these matters”
29. The Information Commissioner responded to the appeal on 20 January 2021. The
Commissioner invited the tribunal to uphold the decision notice and dismiss the
appeal. From the response and later written submissions the case for the Information
Commissioner and their core submissions can be summarised as follows
8
a. The information at issue is personal data.
b. The data protection principle in Article 5(1)(a) would be contravened by the
disclosure: the processing would not be lawful, fair and transparent. This is
because there is no lawful basis in Article 6(1) GDPR for this processing. Thus
the exemption in s.40(2) FOIA is applicable as the condition in s.40(3A)
applies.
c. In applying the three stage test only the first element is satisfied. The
Commissioner accepts that there are legitimate interests in transparency,
concerns about the doctor’s safety and concerns about the GMC’s revalidation
process.
d. Disclosure is not necessary because all of those interests can be addressed by
the information already in the public domain (namely, the doctor’s current
licence to practise, revalidation status and relevant Designated Body, as well
as information from the GMC on how it manages revalidations).
e. When balancing the competing interests, disclosure would do little to advance
the legitimate interests at issue; the information is formulaic and procedural
and does not contain any detail on the named doctor’s safety to practise or
experience. On the other side of the balance, disclosure could be distressing to
the named doctor and, either way, it would undermine their reasonable
expectation that this (ordinarily non-public) information would not be
disclosed under FOIA.
30. Having been joined to the proceedings by the Registrar on 23 December 2020, the
GMC responded to the appeal in a document served on 3 February 2021. The case for
the GMC as set out in their response and later submissions can be summarised as
follows
a. The information requested is personal data within the statutory definition.
b. The public disclosure of the doctor’s personal data under FOIA would
contravene Article 5(1)(a) GDPR in that it would be unfair and unlawful. it
would not be in accordance with Article 6(1)(f) GDPR or with any other lawful
processing condition. The GMC agrees with and adopts the Information
Commissioner’s position as set out in the decision notice.
9
c. Doctors reasonably expect that the GMC will consider any complaints it
receives about them in accordance with the fitness to practise regime which is
the appropriate mechanism for investigations into a doctor’s fitness to practise
Based on the GMC’s Publication and Disclosure Policy and its established
practice, the doctor about whom the information is sought would have had a
reasonable expectation of privacy in respect of the information about them
that fell within the terms of the request.
d. Generally, doctors would not expect, and are liable to be concerned and upset
by, disclosures of personal data about them made by the GMC contrary to its
own publication and disclosure policies, and/or that facilitate independent
private lines of inquiry by aggrieved patients who do not accept the GMC’s
decisions in respect of their complaints.
e. The information requested in question 1 had been published while it was
current, but that did not strip the doctor of their privacy rights once that
information was historic and no longer published
f. The information requested in questions 2 and 3 has never been published and
thus fell within the doctor’s reasonable expectation of privacy.
g. The materials in the bundle about that consultation are evidence that the
GMC’s approach to publication is the product of careful thought and analysis,
informed by detailed consultation, aimed at striking the right balance between
transparency and privacy interests. The Tribunal should give significant
weight to the GMC’s approach to the striking of that balance, which draws on
its expertise, experience and careful analysis.
h. The GMC has been transparent with the appellant about its decisions and
reasoning in their response to his complaint. The appellant’s persistence in his
dissatisfaction with what the GMC has explained to him is not a sufficient
reason to provide him with additional personal data about the doctor, so as to
help him with his personal investigations into the doctor’s background. The
appellant’s correspondence and submissions indicate that the appellant
wishes to pursue his own investigation into the doctor in order to “assail” the
doctor’s competence outside of the statutory fitness to practise regime.
i. The prejudicial consequences for he doctor could in principle be outweighed
if there were an adequate justification for the public disclosure of this data
However, the public disclosure of this information about the doctor would not
further any legitimate objective at all, or to any sufficient extent. It would be
10
unfair to the doctor to publish information about his career that he reasonably
understood would not be published.
31. In his reply and later submissions the appellant added to his submissions in his
grounds of appeal. We have read and considered all the submissions he has made
even if not specifically referred to in this document as they run to many pages. This
is a summary of the relevant submissions to the central issues in the case
a. There is no issue about the legal principles to be applied but he does not accept
that the information requested is personal data within the meaning of the
statute.
b. He has taken steps not to disclose the name of the doctor or the details of
“injuries suffered” in the presentation of his appeal. The manner of the
conduct of his investigations is not of relevance to the application of the legal
principles. It is not correct to say that he wishes to “assail” the doctor and the
GMC are wrong to impute motives to his actions. His concern is solely for the
well being of others.
c. There is a public interest in ensuring that regulatory compliance is taking
place. Refusal to disclose the information is contrary to this public interest as
it frustrates the ability of patients to ask questions.
d. The decision of the GMC on whether to communicate the information
requested should not be given any weight as the decision they took as data
controller is contrary to their stated aim of protecting the public and any
deference to the decision of the regulator would reduce accountability.
e. Doctors should have no greater expectation of privacy than other
professionals and if the GMC has led their registrants to believe they have
greater levels of privacy than normal by their policies that does not affect the
legal position which should be as for everyone else.
f. Because there is a legal requirement for revalidation, the information in the
form of dates in that regard does not amount to personal data and there is no
expectation of privacy in relation to them or any likelihood of damage or
distress.
g. It is not practical to monitor the GMC website for real time changes in data
about a doctor
11
Analysis
32. When a person requests information from a public authority there is a duty on that
authority under section 1(1) FOIA to communicate that information to the requestor
(and thereby to the world) unless it is exempt information within the other provisions
of that act. The possible exemption at issue in this case is the application of section 40
which concerns personal data. Personal data is defined as any information relating
to an identified or identifiable living individual.
33. The request asked for the named doctor’s designated body, annual appraisal doctor,
responsible officer from 2015-19 and the dates of his revalidation. We have concluded
that all of the information requested by the appellant in the three questions that made
up his request is personal data. That is because it relates to a living individual and
when coupled with other information (in this case, the terms of the Request) that
individual is clearly identifiable from and in relation to it. It does not matter for these
purposes that the information is “procedural or formulaic” because it relates to the
named doctor in the way required by the legislation.
34. We then turned to consider whether the disclosure of the information to the appellant
otherwise than under FOIA would contravene any of the data protection principles.
In doing so we were focussed on the application of s40(3A)(a), “the first condition”,
which was the condition relied upon in the decision notice at issue.
35. By virtue of the first data protection principle set out in Article 5(1)(a) of the GDPR,
personal data must be processed lawfully, fairly and transparently in relation to the
data subject. The data subject in this case is the named doctor. The processing with
which we are concerned is the potential disclosure of that personal data to the
appellant, and the public at large.
36. In order to be lawful in the context of this case, Article 6(1)(f) of the GDPR must apply
to the processing. We have applied the three part test, each section of which must be
satisfied if there is to be a lawful basis for the processing. That three part test is as
follows
a. Legitimate interest test: whether a legitimate interest is being pursued in the
request for information;
b. Necessity test: whether disclosure of the information is necessary to meet the
legitimate interest in question;
c. Balancing test: whether the above interests override the legitimate interest(s)
or fundamental rights and freedoms of the data subject.
12
37. In the application of the three part test we have concluded, as did the Information
Commissioner in the decision notice that only the first part of the test is satisfied.
38. We accept that there are legitimate interests in transparency, concerns about the
doctor’s safety and concerns about the GMC’s revalidation process. Members of the
public, have a legitimate interest in transparency about the GMC’s discharge of its
regulatory functions, including oversight of the suitability and fitness to practise of
registrant doctors. That is not to say that we have concluded that, in this case, any of
those concerns are well founded, as explained above this decision is not concerned
with resolving the appellant’s concerns on these issues.
39. We considered the point raised by the appellant that a factual error in the decision
notice about a second doctor who the appellant states does not exist. Whether or not
there is a second doctor is immaterial to the analysis we have undertaken about the
legitimate interests at stake. The nature of those interests is unchanged whether or
not there is a second named doctor. There is no dispute in this case about the nature
of the legitimate interests that engage the first part of the three part test.
40. However, the processing (disclosure) is not necessary because it would not further
any legitimate interest. The appellant’s case is that the registration history of the
named doctor would reveal safety issues for patients. He has two arguments first,
the pattern of changes between Designated Bodies would reveal safety issues, and
second, errors in previous entries would show safety issues. However, the
information he requests is procedural and formulaic and at most would reveal only
the variety in the doctor’s career which of itself in not capable of properly founding
any inference about the safety of their practice. Whether or not a doctor has had a
varied career, of itself, says nothing about their fitness to practise, safety or
competence. No negative inferences could reasonably be drawn from a doctor
changing their Designated Body. Similarly, if there are errors in the information this
will reveal nothing about such legitimate interests. Errors in revalidation entries, for
example due to a doctor misinterpreting the application of the 2010 Regulations, are
not indicative of safety concerns
41. The requested personal data would not further the legitimate interests because there
is no connection between the legitimate interests on which the appellant relies and
the personal data he seeks. Even if disclosure of this personal data were connected to
any such legitimate interests, it would not be reasonably necessary for the
furtherance of those interests. Such information would not help individuals explore
or take further any concerns they may have about particular doctors, and it would
not help them scrutinise the GMC’s discharge of its regulatory functions. Such
objectives can be taken forward without the information requested via the external
13
complaints process and the statutory appeals/review processes or indeed the
remedy of judicial review. Furthermore the current information about doctors is
published which enables the timely making of complaints about practitioners. The
disclosure of this personal data would not serve a legitimate interest and thus the
necessity test is not satisfied.
42. Even though we have concluded that the second part of the test is not satisfied and
this would suffice to dispose of the point we have gone on to consider the third aspect
in the event we are in error on that point.
43. The third part of the test requires the balancing of the legitimate interests in the
processing against the legitimate interest(s) or fundamental rights and freedoms of
the data subject, in this case the named doctor. We have decided that the processing
is unwarranted, or overridden, in this case by reason of prejudice to the data subject’s
rights, freedoms and legitimate interests. That is because
a. The data subject has a reasonable expectation of privacy which would be
undermined by such disclosure
i. The information has never been published or was not published at the
time of the request and response to that request
ii. Disclosure under FOIA would be a departure from the published
policy and usual practice of the GMC
iii. Disclosure under FOIA is unrestricted as to the use that the information
may be put to be the requestor or the world at large
iv. Disclosure of this information would mean that the named doctor
would be being treated in a different way to other doctors
b. Any disclosure could be distressing to the named doctor and facilitate private
investigations more properly conducted by the regulator
c. Issues about whether the revalidation history of all doctors should be made
public is not a matter for this tribunal. This appeal is solely about the lawful
response to a request made under FOIA and arguments about the adoption of
another regulatory system have no relevance. The requested information has
no necessary, or clear, connection with safety. It is too remote from any issues
relating to a doctor’s fitness to practice or to the effective discharge of the
GMC’s revalidation and other regulatory functions. The disclosure of the
information would advance the legitimate interests of the appellant by at most
a minimal degree.
14
44. To the extent there is a need to consider the named doctor’s rights under Article 8
ECHR we have concluded that the disclosure of this data would be unlawful because
a. The doctor reasonably expected the GMC to keep the information private
b. Its public disclosure would be liable to cause upset
c. No “pressing social need” would be furthered by that disclosure,
d. Public disclosure would be unnecessary and disproportionate.
45. We considered whether there was a distinction to be drawn between the information
requested in question 1 that had previously been published and that requested in
parts 2 and 3 which had never been published by the GMC. We noted that at the time
of the request none of the information was published and thus it could be argued
that the distinction proposed is illusory. However, we do not find it necessary to
determine that point given that we have accepted and give weight to the carefully
considered GMC policy decision, as the statutory regulator, that the protection of the
public does not require the publication of historic data but only current data. The
data is lawfully processed by being held in order to facilitate the GMC’s regulatory
function in case of any future complaint. Processing by way of disclosure of any of
the information sought is not necessary to protect the public nor allow performance
of the regulatory functions of the GMC.
46. As neither the second or third part of the three part test is satisfied the processing of
the named doctor’s personal data by disclosure as requested under FOIA would not
be lawful because none of the reasons listed in Article 6(1) applies to the processing.
Thus such processing would contravene the first data protection principle set out in
Article 5(1)(a) of the GDPR, (see section 40(3A)(a) FOIA) and therefore it is exempt
pursuant to section 40(2) FOIA.
47. We make it clear that for the reasons set out above we have also concluded that the
processing would be unfair in relation to the named doctor as data subject. This also
amounts to a contravention of the first data protection principle that would engage
the exemption.
Conclusion
48. The requested information is accordingly exempt under section 40(2) FOIA, because
it is the personal data of the named doctor, and its disclosure to the public would be
unfair and not justified by reference to any lawful processing condition from Article
15
6(1) GDPR. The Information Commissioner’s analysis of this case, as set out in her
decision notice was not in error of law and contained no wrongful exercise of
discretion.
49. For these reasons the appeal is dismissed.
50. Pursuant to rule 14 of the tribunal rules it is ordered that any matter likely to lead
members of the public to identify the doctor about whom the complaint was made
shall not be disclosed or published to any third party in relation to these proceedings
and no person shall be provided with a copy of the open bundle or any other
document or correspondence sent to the tribunal in this appeal without the leave of
this tribunal, the Upper Tribunal or a court. This is because the open bundle makes
reference to the doctor about whom the complaint was made and I am satisfied such
disclosure would be likely to cause that person serious harm; and I am satisfied,
having regard to the interests of justice, that it is proportionate to give such a
direction.
Signed Judge Griffin Date: 4 October 2022
16