Tag: sensitive personal data

‘Vilified’ doctor cannot publish patient’s private information

Posted on | by Robin Hopkins
In the Matter of C (A Child) (Application by Dr X and Y) [2015] EWFC 79 involved, in the words of Munby J, an unusual and indeed unprecedented application. It pitted the right to defend one’s reputation against the privacy and confidentiality rights of others. In this case, the latter won.
Dr X had treated C and C’s mother; he had also been an expert witness in the family court care proceedings concerning C. C’s mother was unhappy about the treatment given by Dr X. She complained about him to the GMC, whose Fitness to Practise panel in due course found the allegations against Dr X to be unproven. C’s mother also criticised Dr X publicly in the media.
Dr X felt that his “otherwise unblemished reputation … has been cataclysmically damaged … through inaccurate reporting and internet postings” and that he has been “unfairly and unjustly pilloried by the mother and, through her, by the press” (his skeleton argument, cited at para 10 of Munby J’s judgment).
Dr X wanted to be able to put his side of the story, and to have the original source documents – from the family court proceedings and the Fitness to Practice proceedings – available, to quote from (while respecting anonymity) if his public statements were challenged. He sought disclosure of documents from those proceedings.
One difficulty he faced was that the law restricts the use to which documents from family proceedings could be put. The court had a discretion to allow disclosure, but generally subject to restrictions on the use to which documents could be put.
A further major difficulty was that he was bound by doctor-patient confidentiality, both as a matter of legal duty and professional confidentiality. That duty permits of exceptions – for example, to allow a doctor who is being unfairly vilified by a patient to defend himself – but even then any departure from confidentiality obligations must be proportionate.
The same applies to interference with patients’ privacy under Article 8 ECHR; privacy rights were particularly acute here, because what was sought (for disclosure, and for deployment in public statements) was “a mass of medical materials relating to the mother’s mental health” (Munby J at paragraph 42). Disclosure of those materials, even in redacted form, would have major implications for the privacy of the child, C.
Those difficulties were fatal to the application. Munby J said that “the remedy being sought by Dr X – permission to put the mother’s medical records and related documents into the public domain, at a time and in circumstances of his own choosing and without any of the safeguards usually imposed – is wholly disproportionate to anything which he can legitimately or reasonably demand”.
In relation to the documents filed in the Fitness to Practise proceedings but which were not part of the documentation filed in the care proceedings, the court had no jurisdiction to grant an application for disclosure. In any event, disclosure of the confidential material Dr X sought for deployment in the public domain would again be wholly disproportionate.
Heather Emmerson of 11KBW appeared for the GMC.​
Robin Hopkins @hopkinsrobin

The Data Protection Act in defamation cases: increasingly relevant, potentially primary?

Posted on | by Robin Hopkins

The Data Protection Act 1998 is increasingly being deployed as part of a claimant’s arsenal in defamation claims. The Information Commissioner has historically resisted policing DPA breaches in the context of allegedly defamatory expressions of opinion by one person about another.

Courts, on the other hand, have accepted that expressions of opinion about individuals are (as the definition at section 1 of the DPA makes clear) personal data, and that the DPA can therefore bite. This has arisen, for example, in the context of Norwich Pharmacal claims seeking the disclosure of the identities of users posting allegedly defamatory material. See for example Applause Store Productions Ltd and another v Raphael [2008] EWHC 1781 (QB), on which Anya posted here.

The use of the DPA in defamation claims (or cases which, though brought under the DPA, look in substance like defamation claims) has, it seems, gathered momentum. In late 2011, Tugendhadt J gave judgment in a case about the ‘solicitors from hell’ website:  The Law Society and others v Rick Kordowski [2011] EWHC 3185 (QB), on which Rachel Kamm posted here.

Last month, the DPA was again successfully relied upon as founding an arguable defamation-type claim. Desmond v Foreman, Shenton, Elliott, Cheshire West and Cheshire Council and Cheshire East Council [2012] EWHC 1900 (QB), involved a cover teacher who was suspended and ultimately dismissed following allegations that he had conducted himself in an inappropriate sexual manner towards a sixth-form student. The case involved a number of communications: meetings to discuss the allegations; requests for information from the police and previous employers; referrals to the Independent Safeguarding Authority, and queries about his home situation made by an officer of one local authority to an officer at another.

The claimant contended that a number of these communications implied that he was actually guilty of and had actually committed various serious offences (including rape, of which he had been accused in 2001 but exonerated through court proceedings). He brought a defamation claim, also contending that the allegedly defamatory statements infringed his rights under Article 8 and the DPA (in particular, breaches of data protection principles 1, 2, 3, 4 and 6).

The defendants – two local authorities, a headmaster and two local authority officers – sought summary judgment. They said the communications complained of were no more than expressions of concern that matters needed investigating, they asserted qualified privilege (based on the performance of their public duties) and justification.

The judge – as in Kordowski, Tugendhadt J – dismissed the application for summary judgment in part, finding that the claimant’s case under Article 8 and the DPA had a real prospect of success in relation to some of the communications complained of.

The judgment is of interest not only as an illustration of the difficulties of lawfully sharing sensitive information (including opinions) in the context of safeguarding children. It also illustrates that the DPA is increasingly – and realistically – being pressed into the service of types of complaint traditionally brought under other heads. The DPA and Article 8 are, of course, long-standing and natural complements to each other. Defamation, however, is slightly more alien territory for the DPA. Copyright infringement (on which, see a post of mine from last year here) is another area to which the DPA is increasingly relevant.

What, it is sometimes wondered, does a claim under the DPA add which is not already covered by claims under Article 8, defamation and so on? After all, as the defendants in Desmond argued, if someone is aggrieved at DPA breaches, then he has another remedy available, namely a complaint to the ICO. Interestingly, Tugendhadt J’s judgment in Desmond reverses this: what, he asked, would an Article 8 or defamation claim add to the DPA claim – at least with respect to one of the communications complained of? In particular, he was concerned with how best to deal with the claim that information about the 2001 rape allegation had been processed (retained, communicated) without reference to the judgments exonerating the claimant.

This last point about fair and accurate records of serious allegations is important: see an older post of mine here.

For the moment, back to Desmond and how best to deal with legal claims about this sort of complaint. Tugendhadt J said this:

“81. How and why it is that the references to the 2001 incident came to be recorded, but recorded without mentioning the public judgments of the court containing the police’s explanation for not charging the Claimant, is a question for which the proceedings under the DPA may provide the most appropriate form of investigation (as the Court of Appeal suggested in para 51 of their judgment). It is for consideration whether claims under the HRA or in defamation would add any benefit to the Claimant over and above a claim under the DPA. And as noted above, a claim under the DPA appears to raise no issues of limitation.

82. I invited the parties to consider why the Court should not direct that the claim under the DPA proceed first and separately from the other two claims, and give directions as to the filing of evidence (or agreed statements of facts) so that the matter could be determined in accordance with the overriding objective, and in particular with the objective of allotting to the case an appropriate share of the court’s resources.”

This demonstrates that, at least in some circumstances, the DPA may appropriately play the lead role rather than a supporting one in a complaint about unjustifiable and damaging communications about individuals. It looks as if the DPA will continue to flex muscles it did not even know it had.

Robin Hopkins

NICK GRIFFIN IN THE TRIBUNAL: APPLICANT BLINDNESS, THE “JOURNALIST’S ROUTE” AND ARTICLE 10

Posted on | by Robin Hopkins

BNP leader Nick Griffin was convicted in 1998 for publishing material likely to stir up racial hatred. In 2009, Ian Cobain, an investigative journalist at The Guardian, requested sight of all Crown Prosecution Service papers relating to that prosecution. The Commissioner upheld its refusal. In Cobain v IC and Crown Prosecution Service (EA/2011/0112 & 0113), the Tribunal considered 3 exemptions, namely ss. 40(2), 32(1) and 30(1) of FOIA. For the most part, Mr Cobain’s arguments prevailed.

The decision is notable – indeed, essential reading – for a number of its key points. For example: when it comes to journalists requesting sensitive personal data, FOIA is not “applicant blind”. More generally, the decision affirms the importance of FOIA in facilitating investigative journalism. The approach to Article 10 ECHR from the Kennedy “report” is boldly affirmed. General guidance on s. 30(1) is set out. I’ll look at the key points from each exemption in turn. The decision is worth quoting in some detail.

Section 40(2) (personal data)

A number of important points emerge. First, in general, just because information emerged during evidence in a public trial, this does not mean it should automatically be disclosed under FOIA:

“Much of the information… was freely publicised at the trial in 1998… Where the public interest is engaged (as here where s. 30(1)(c) is invoked) it does not by any means automatically follow that such publication in the past determines the question of disclosure today. Most witnesses are entitled to expect that their exposure to public scrutiny ends with the conclusion of their evidence. Those who make statements do so in the expectation that, if not used at trial, they will not surface later.”

Secondly, just because information is in a prosecution file, it does not follow that it is necessarily personal data. The Commissioner was criticised for insufficiently granular analysis:

“It was clear that the broad and unparticularised approach adopted in the First Decision Notice could not be upheld. The fact that it is information held in a file assembled for the purposes of criminal proceedings against Mr. Griffin (see DPA s.2(g)) does not make it sensitive personal data, unless it is personal data in the first place.”

Some of the disputed information was therefore outside s. 40(2) because it was not personal data in the first place. Other information, however, was sensitive personal data. This meant that not only would the usual conditions need to be met (fairness, lawfulness, condition 6(1)) but a Schedule 3 condition was also mandatory. Those can be difficult to meet – unless you are a journalist. Condition 10 triggers the Data Protection (Processing of Sensitive Personal Data) Order 2000. This contains particular “lawful processing” conditions for the purposes of, among other things, journalism: see article 3 of the Order, which also imposes other conditions such as the disclosure being in the “substantial public interest” and “in connection with” issues such as “the commission of an unlawful act”. Paragraphs 31-33 of the Tribunal’s decision contain a useful summary of how the relevant provisions work.

This “journalist’s route” (my term, rather than the Tribunal’s) to obtaining sensitive personal data has been considered in a number of Tribunal decisions. In this case, it was given full effect:

 “Disclosure of the sensitive data would be “in connection with” the commission of an unlawful act (hence the conviction), seriously improper conduct and arguably Mr. Griffin`s unfitness for political office. It would be for the purpose of journalism, Mr. Cobain`s occupation, and would be intended for publication in his newspaper and possibly thereafter, in a book. Given the issues involved, namely racial and/or religious hatred and the right to express even extreme views, we find that disclosure would be in the substantial public interest. We do not consider that the passage of eleven years before the request renders disclosure unfair, or unwarranted by reason of prejudice to Mr. Griffin`s interests nor likely to cause substantial damage or distress to him. In making that judgement we have regard to Mr. Griffin`s age ( 50 at the date of the request, 39 at the date of trial), his continuing political prominence and his apparent claim to be an educated, reasonable and responsible MEP and party leader who has rejected any racial extremism formerly associated with his party.”

How does this “journalist’s route” square with the usual “applicant blindness” FOIA principle? The ICO argued that the latter prevails, such that the former only applies to pure DPA cases, not to FOIA ones. It emphasized the wording of s. 40(3)(a): disclosure to “a member of the public otherwise than under [FOIA]”. It argued that the average member of the public is the reference point for a FOIA disclosure. The average member of the public is not a journalist. The “journalist’s route” therefore has no place in FOIA.

The Tribunal disagreed (as the First-Tier Tribunal has done on a number of occasions now). It relied on the Upper Tribunal’s judgment in the APPGER case on this point, and said that:

 “… a requester who fulfils one or more of the schedule conditions is also a member of the public ( and is not the data processor ) who is receiving the information under FOIA. If this were not so, FOIA would be a valueless tool for the serious researcher, journalist, writer, politician or scholar seeking to investigate serious wrongdoing within the preceding thirty years. If that were the case, it would be reasonable to ask whether FOIA was worth enactment.”

The effect in this case was that s. 40(2) did not apply at all.

Section 32 (court records)

Next, the CPS relied on s. 32, the ambiguous wording of which has opened the door for Article 10 ECHR arguments: see the Kennedy v Charity litigation (Panopticon passim) in which the First-Tier Tribunal’s “report” on the application and effect of Article 10 on s. 32 will be considered by the Court of Appeal later this month. The Tribunal in Cobain wholeheartedly adopted the Kennedy report:

“We adopt with gratitude and respect the very careful reasoning of the report on this issue, which we believe accurately states the law as to Article 10 as recently developed… We do not doubt that s. 32(1) can be read down in a way which is consistent with Article 10. We consider that limiting the restriction in [s. 32(1)] so that it ends once a reasonable time has elapsed after the exhaustion or evident abandonment of the available appeal process would avoid a breach of Article 10.”

Consequently, s. 32 was not available as a ground for refusal in this case.

The Article 10 issue is obviously of enormous importance to the interpretation of FOIA – particularly, but not exclusively for journalists. As things stand, the role of Article 10 is uncertain. At least two other First-Tier Tribunals have heard or will hear argument on it this month (in the contexts of ss. 23, 40(2) and 41); the Court of Appeal will consider it in two cases this month, and the Supreme Court gives judgment in Sugar v BBC next week. Watch this space.

Section 30(1) (investigations)

In the context of this case, this exemption was “unarguably” engaged. The Tribunal made the following observations about the public interest in maintaining this exemption:

“The Tribunal acknowledges the substantial public interest in many circumstances in protecting from disclosure information gathered for the purposes of a criminal case, including the need to offer informants and witnesses protection from public exposure and a prosecuting authority a proper space in which to discuss and decide issues that arise.”

As against that, it said this about the public interest in disclosure:

“On the other hand, the public has a legitimate interest in criminal investigations and resulting court proceedings, especially where the defendant was a prominent political figure charged with an offence of great current importance in proceedings that he was keen to publicise. The passage of time is also a consideration. Legitimate public interest in such a case continues due to the profile of the defendant but the risk of any impact on the resulting proceedings disappeared long ago. More importantly, the relevant information in this appeal does not include statements from potentially vulnerable witnesses or highly sensitive material”.

The Tribunal therefore concluded that, in general, the public interest favoured the disclosure of the disputed information in this case, except for three categories which could properly be withheld.

On s. 30(1), this decision is a useful summary of the most relevant considerations. It is on ss. 40(2) and Article 10, however, that it has given a fresh boost to requesters.

Robin Hopkins

JUDICIAL REVIEW AND THE DPA: PATIENT’S CONSENT VITAL

Posted on | by Robin Hopkins

The Court of Appeal last week gave judgment in R (on the application of TA) v North East London NHS Trust (not yet reported or publicly available). The case is an interesting illustration of (a) the Data Protection Act 1998 being used as a ‘shield’ in an application for judicial review, and (b) the vital importance of patient consent in the use of medical records.

TA was engaged in family court proceedings with his ex-wife concerning custody of their children. Part of her evidence in support of her suitability to care for the children was the report of a psychiatrist at the defendant NHS Trust. According to that report, TA’s ex-wife did not suffer from a mental health disorder. TA complained to the Trust about this report. It refused to investigate the refusal because to do so would require it to access his ex-wife’s medical records. She had refused her consent to that access, and the Trust’s position was therefore that it could not investigate TA’s complaint without breaching the data protection principles in its processing of his ex-wife’s (sensitive) personal data. TA’s application for judicial review of the Trust’s refusal failed. So too did his appeal to the Court of Appeal.

Robin Hopkins

IS FOIA ALWAYS MOTIVE BLIND? TRIBUNAL DECISION ON SEX OFFENDERS’ SENSITIVE PERSONAL DATA

Posted on | by Robin Hopkins

In Colleen Smith v IC and Devon & Cornwall Constabulary (EA/2011/0006), the requester asked for information on the number of school teachers in specified towns who had been investigated, cautioned and charged under the Sexual Offences Act 2003 between January 2005 and November 2007. The Constabulary eventually relied on the personal data at section 40(2) FOIA.

The Commissioner found that, where the answer was “zero”, this was not personal data and should be disclosed; otherwise, the information could be withheld under section 40. The Tribunal has upheld this decision, albeit for different reasons.

This decision is worth noting on a number of grounds.

First, this is a good illustration of the approach from Department of Health v IC [2011] EWHC 1430 (Admin) (the “abortion statistics” case – see my post here) to the definition of “personal data” in the context of apparently anonymous statistics. Here the Tribunal considered both the disputed information concerning numbers of alleged sex offenders and the “other information” held by the Constabulary, and was satisfied that living individuals could thereby be identified. Furthermore, for obvious reasons, this constituted “sensitive personal data”.

Secondly, the Tribunal turned to fairness of disclosure. As regards reasonable expectations of data subjects, it concluded (for confidential reasons, and notwithstanding that one can generally assume sensitive personal data will not be disclosed) that the data subjects in these circumstances could have had no reasonable expectation that these statistics would not be disclosed at the relevant time, i.e. late 2007.

Thirdly, the Tribunal also disagreed with the Commissioner that disclosure created a risk of harm to the suspected offenders at the relevant time.

Fourthly, the Tribunal considered whether a condition from Schedule 3 of the DPA 1998 would be met. It did so by asking itself whether paragraph 3 of the Schedule of the Data Protection (Processing of Sensitive Personal Data) Order 2000 applied. That concerns, inter alia, disclosure of information concerning alleged unlawful acts for “special purposes” such as journalism. Disclosure must, however, be “in the substantial public interest”.

The “special purpose” of journalism highlights the following important reminder. It is by now axiomatic that FOIA is “motive blind”. However, the cases of Ferguson v IC (EA/2010/0085) (on which, see my post here) and Brett v IC (EA/2008/0098) imposed an important gloss on that principle. The Tribunal in Ferguson summed up the point thus:

“It is often stated that requester’s rights under FOIA are purpose-blind, in the sense that an applicant’s personal identity and motives for requesting information are irrelevant. This generalisation can mislead. There are some cases in which the applicant’s identity and motives may shed light on the public interests involved. More significantly, the applicant’s identify and motives can be of direct relevance to the exemption in FOIA s40(2) because of the provisions of DPA disclosure and to the interests pursued by the persons to whom the disclosure would be made. For example, a journalist or author may be able to outflank the s40(2) exemption by reliance upon DPA Schedule 3 condition 10 and paragraph 3 of the Schedule to the Data Protection (Processing of Sensitive Personal Data) Order 2000, where it is in the substantial public interest that wrongdoing should be publicised.”

The Tribunal in Smith agreed. The appeal, however, failed because disclosure of this information would not be “in the substantial public interest”.

The Tribunal thought it “reasonable to assume… that the public had an ongoing need for reassurance as to the level of activity by sexual offenders in particular localities and transparency and accountability in what the police were doing about it”. The threshold of “substantial public interest”, however, required a certain level of urgency in the need to reassure the public. That threshold was not met here.

In reaching this conclusion (which the Tribunal described as “finely balanced”), the Tribunal took into account: the evidence as to the machinery for the monitoring and supervision of sex offenders in the community; the risk of vigilantism, which can force suspects to “disappear”, which in turn increases the risk of reoffending. It added that:

“It was not enough, in the Tribunal’s view, that sexual offences by teachers or others in positions of trust was a matter of keen interest to the public. This, on its own, did not make disclosure “in the substantial public interest”. It was the Tribunal’s task to weigh against the wholly understandable concern felt by members of the public on this subject, the detrimental effects that disclosure could have.”

The upshot was that, although disclosure would be fair, section 40(2) took effect because no Schedule 3 condition would be met.

Robin Hopkins