General Dental Council v Savery & Ors

This is an application by the General Dental Council (“GDC”) for a declaration that the GDC may use and disclose the dental records of fourteen patients and former patients of the fifteenth interested party (“Dr Al-Naher”), who is a registered dentist.

The GDC wishes to be able to use the patient records for the purposes of professional disciplinary proceedings which have been commenced against Dr Al-Naher. The GDC wishes to establish that the registrar of the GDC (and those working in his office), who already have copies of the relevant patient records in their possession, may pass those records to the Investigating Committee of the GDC (“the Investigating Committee”) to enable that committee to conduct an investigation into the allegations of professional misconduct and impairment of fitness to practise against Dr Al-Naher, which have been referred to the Investigating Committee by the registrar; and that, if the Investigating Committee decides that the allegations ought to be referred to the relevant Practice Committee of the GDC (“the Practice Committee”, probably the Professional Conduct Committee in this case) for hearing and determination, it will be lawful for it, in turn, to pass the patient records to that committee so that a full hearing before that committee may proceed with reference to all evidence which is relevant to those allegations.

A major issue between the parties is whether the various organs of the GDC referred to are entitled to pass the patient records on without the need of first applying to the court for its approval for them to proceed in that way.

Mr Winter QC for Dr Al-Naher submits that the GDC is obliged to apply to court for permission to use or disclose the records for the purposes of its disciplinary functions, so as to enable the court to supervise that process. He also submits that in this case the court should refuse to grant permission to the GDC to do so and should declare that it would be unlawful for the GDC to do so.

The claim has been issued without naming a defendant, pursuant to permission granted by David Elvin QC, sitting as a Deputy High Court Judge. Instead, Dr Al-Naher and the fourteen patients whose records are in issue have been named as interested parties.

Efforts have been made by the GDC to contact all of the patients to obtain their consent to the use of their records for the purposes of the professional disciplinary proceedings against Dr Al-Naher. Of the fourteen patients, ten have explicitly refused to give their consent and four have not replied to the GDC’s enquiries. The net effect, therefore, is that in relation to all fourteen of the patients there is an absence of consent to the use of their records by the GDC for the purposes of the professional misconduct proceedings against Dr Al-Naher.

The functions and operation of the GDC are governed by the Dentists Act 1984 (“the 1984 Act”). Section 1 establishes the GDC. Section 1(2) provides:

“The Council shall, when exercising their functions under this Act, have a general concern-

(a)

to promote high standards of education at all its stages in all aspects of dentistry; and

(b)

to promote high standards of professional conduct, performance and practice among persons registered under this Act.”

Section 2 provides for there to be various committees of the GDC. In relevant part it states as follows:

“(1)

There shall continue to be committees of the Council known as-

(a)

the Professional Conduct Committee; and

(b)

the Health Committee.

(2)

There shall also be established committees of the Council to be known as-

(a)

the Investigating Committee;

(b)

the Professional Performance Committee;

(c)

the Interim Orders Committee; …

(3)

In this Act, “Practice Committee” means the Professional Conduct Committee, the Health Committee or the Professional Performance Committee. …”

Section 26B provides for the GDC to issue guidance as to the standards of conduct, performance and practice expected of registered dentists. Section 27 provides in relevant part as follows:

“27 Allegations

(1)

This section applies where an allegation is made to the Council against a registered dentist that his fitness to practise as a dentist is impaired.

(2)

A person’s fitness to practise as a dentist shall be regarded as “impaired “ for the purposes of this Act by reason of-

(a)

misconduct;

(b)

deficient professional performance;…

(4)

This section also applies in a case where-

(a)

it comes to the attention of the Council that a registered dentist’s fitness to practise as a dentist may be impaired on one or more of the grounds mentioned in subsection (2), but

(b)

no allegation to that effect has been made to the Council against that person,

and in such a case this Act shall apply as if an allegation or allegations to the effect that the person’s fitness to practise as a dentist is impaired on the ground or grounds in question had been made to the Council against that person.

(5)

The registrar-

(a)

shall refer the allegation to the Investigating Committee; and

(b)

may also, if he considered it appropriate, refer the allegation to the Interim Orders Committee.

(6)

The registrar shall investigate the allegation for the purpose of exercising his functions under subsection (5). …”

The role of the registrar in relation to investigation of allegations against dentists is also governed by the General Dental Council (Fitness to Practise) Rules 2006 (“the Rules”). Rules 3 and 4 provide in relevant part as follows:

“Initial consideration by the registrar

3.

The registrar shall consider a complaint or other information in relation to a registered dentist or a registered dental care professional, including a dentist or dental care professional whose registration is suspended, and shall determine whether a complaint or information amounts to an allegation.

Notification of allegation

4.

–(1) Where the registrar determines that a complaint or information amounts to an allegation, he shall send a notification to the respondent and the maker of the allegation (if any) accordingly.

(2)

The notification sent under paragraph (1) shall-

(a)

contain a summary of the allegation;

(b)

subject to rule 7(3), be accompanied by a copy of the documents in the registrar’s possession which relate to the allegation;

(c)

invite the respondent to respond to the allegation with written representations addressed to the Investigating Committee within a period which the registrar shall specify in the notification; and

(d)

where the allegation has been made by a person, inform the respondent that representations received from him may be disclosed to that person for comment. …”

Section 27A of the 1984 Act provides in relevant part as follows:

“27A The Investigating Committee

(1)

Where the registrar refers an allegation under section 27 to the Investigating Committee, they shall investigate the allegation and determine whether the allegation ought to be considered by a Practice Committee.

(2)

If the Investigating Committee determine that the allegation ought not to be considered by a Practice Committee, the Investigating Committee may-

(a)

issue a warning or advice to the person who is the subject of the allegation regarding his future conduct, performance and practice; and

(b)

issue advice to any other person involved in the investigation on any issue arising in the course of the investigation.

(3)

If the Investigating Committee issue a warning under subsection (2)(a), they may, if they consider it appropriate to do so, direct the registrar to enter details of that warning in the entry in the register relating to the person who is the subject of the allegation.

(4)

Unless subsection (5) applies, if the Investigating Committee determine that the allegation ought to be considered by a Practice Committee, the Investigating Committee –

(a)

shall refer the allegation-

(i)

to the Professional Performance Committee, in the case of an allegation based on the ground mentioned in section 27(2)(b) (deficient professional performance),

(ii)

to the Health Committee, in the case of an allegation based on the ground mentioned in section 27(2)(c) (adverse physical or mental health), or

(iii)

to the Professional Conduct Committee, in any other case; and

(b)

may also, if they consider it appropriate, refer the allegation to the Interim Orders Committee. …”

Where there are allegations of varying character, section 27A(5)–(8) allows for the Investigating Committee to choose which particular Practice Committee is the most appropriate to consider the group of allegations.

Section 27B provides in relevant part as follows:

“27B The Practice Committees

(1)

Subject to subsection (4), a Practice Committee must investigate an allegation or allegations against a person referred to them by the Investigating Committee under section 27A and determine whether that person’s fitness to practise as a dentist is impaired. …

(5)

If a Practice Committee determine that a person’s fitness to practise as a dentist is not impaired, they-

(a)

shall publish at his request a statement to that effect; or

(b)

may publish such a statement if he consents.

(6)

If a Practice Committee determine that a person’s fitness to practise as a dentist is impaired, they may, if they consider it appropriate, direct-

(a)

(subject to subsection (7)) that the person’s name shall be erased from the register;

(b)

that his registration in the register shall be suspended during such period not exceeding twelve months as may be specified in the direction;

(c)

that his registration in the register shall be conditional on his compliance, during such period not exceeding three years as may be specified in the direction, with such conditions specified in the direction as the Practice Committee think fit to impose for the protection of the public or in his interests; or

(d)

that he shall be reprimanded in connection with any conduct or action of his which was the subject of the allegation. …”

It may thus be seen that the 1984 Act provides for a screening or triage mechanism. First, the registrar (or his staff) will review any allegation or information coming to the GDC’s attention to determine whether it constitutes an allegation of impairment of fitness to practise. If he determines that it does, the registrar “shall refer” the allegation to the Investigating Committee (section 27(5)(a)) (and may refer it to the Interim Orders Committee if appropriate, e.g. if it is necessary to consider making an immediate interim order for the purpose of protecting the public).

Where the Investigating Committee has an allegation referred to it by the registrar, it “shall investigate the allegation” and decide whether it ought to be referred to one of the Practice Committees or whether its own powers are sufficient to deal with it (section 27A(1) and (2)). If the Investigating Committee determines that the allegation is so serious that it ought to be considered by a Practice Committee, it “shall refer the allegation” to the relevant Practice Committee (section 27A(4)(a)). In that case, the Practice Committee comes under an obligation to investigate the allegation (section 27B(1): “must investigate”) and may impose a range of sanctions of potentially significant severity (section 27B(6)).

The clear intention of the statute is that if an allegation of impairment of fitness to practise is made, the allegation should be referred to the Investigating Committee for investigation and, if serious, should be referred on to the relevant Practice Committee for investigation, with a view to it imposing an appropriate sanction if the allegation is found to be established. The existence of such an investigatory procedure and its effective implementation are fundamental to maintaining the confidence of the public in the dentists’ profession.

Section 33B of the 1984 Act provides in relevant part as follows:

“33B The Council’s power to require disclosure of information

(1)

For the purpose of assisting the Council or any of their committees in carrying out functions under this Part, the council may require a person (“the relevant party”) whose fitness to practise as a dentist is in question, to provide details of any person-

(a)

by whom the relevant party is employed to provide services in, or in relation to, any area of dentistry; or

(b)

with whom he has an arrangement to provide such services.

(2)

For the purpose of assisting the Council or any of their committees in carrying out functions under this Part in respect of a person’s fitness to practise as a dentist, the Council may require any person (except the person in respect of whom the information or document is sought) to supply any information or produce any document in his custody or under his control which appears to the Council relevant to the discharge of those functions.

(3)

Nothing in this section shall require or permit any disclosure of information which is prohibited by any relevant enactment.

(4)

For the purposes of subsection (3), “relevant enactment” means any enactment other than-

(a)

this Act; or

(b)

the non-disclosure provisions within the meaning of Part 4 of the Data Protection Act 1998 (see section 27 of that Act).

(5)

A person shall not be required to supply any information or produce any document under subsection (2) which he could not be compelled to supply or produce in civil proceedings before the relevant court.

(6)

In subsection (5) “the relevant court” means - ….

(c)

in any other case, the High Court in England and Wales.

(7)

If a person fails to supply any information or produce any document within 14 days of being required to do so under subsection (1) or (2), the Council may seek an order of the relevant court requiring the information to be supplied or the document to be produced.

(8)

In subsection (7), “the relevant court” means the county court. …

(10)

For the purposes of subsection (4), “enactment” includes-

(a)

a provision of, or an instrument made under, an Act of the Scottish Parliament;

(b)

a provision of, or an instrument made under, Northern Ireland legislation; and

(c)

a provision of subordinate legislation (within the meaning of the Interpretation Act 1978).”

Interpreting the 1984 Act and the Rules in the present context, where Article 8 of the European Convention on Human Rights (specified as a Convention right by section 1 of the Human Rights Act 1998 – “the HRA”) confers rights to privacy in relation to patients’ medical records, and in assessing the obligations of the GDC, it is also relevant to have in mind section 3(1) and section 6(1) and (2) of the HRA. These state:

“3Interpretation of legislation.

(1)

So far as it is possible to do so, primary legislation and subordinate legislation must be read and given effect in a way which is compatible with the Convention rights. …

6 Acts of public authorities.

(1)

It is unlawful for a public authority to act in a way which is incompatible with a Convention right.

(2)

Subsection (1) does not apply to an act if—

(a)

as the result of one or more provisions of primary legislation, the authority could not have acted differently; or

(b)

in the case of one or more provisions of, or made under, primary legislation which cannot be read or given effect in a way which is compatible with the Convention rights, the authority was acting so as to give effect to or enforce those provisions.”

Article 8 provides:

“1.

Everyone has the right to respect for his private and family life, his home and his correspondence.

2.

There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well being of the country, for the prevention of disorder and crime, for the protection of health and morals, or for the protection of the rights and freedoms of others.”

Also of relevance in the present context is the Data Protection Act 1998 (“the DPA”). In many contexts the GDC may obtain medical records of patients in computerised form or hold the information in other records and then be involved in processing these data, so that the safeguards in the DPA come to apply (see the wide definitions of “data” and of “processing” in section 1(1) of the DPA). Medical records of a patient will be “sensitive personal data” since they consist of information “as to … his physical or mental health or condition” (section 2(e) of the DPA). Accordingly, the data protection principles in Schedule 1 to the DPA will apply and processing by the GDC of the data contained in the medical records (including processing by passing those data from registrar to Investigating Committee to Practice Committee) will require to be justified under both Schedule 2 and Schedule 3 to that Act: see section 4 of the DPA.

Schedule 2 to the DPA permits processing of data where that “is necessary… for the exercise of any functions conferred on any person by or under any enactment” (paragraph 5(b)). Paragraph 7(b) of Schedule 3 to the DPA is to similar effect. According to these provisions, therefore, medical records obtained by the GDC may lawfully be used by the GDC and its committees in carrying out their statutory functions to investigate and, as appropriate, to impose relief or sanctions in relation to allegations of impairment of fitness to practise. It should be noted that the extent of the statutory functions of the GDC and its committees (and hence the extent of the justification allowed on the basis of these paragraphs in Schedules 2 and 3 to the DPA) will be defined by provisions of the 1984 Act interpreted, as appropriate under section 3(1) of the HRA, in such a way as to conform with Convention rights.

The fourteen patients who are interested parties in these proceedings each took out dental health insurance with an insurance company called HSA Simplyhealth Group (“HSA”). Where dental work was carried out by Dr Al-Naher on the patients, the procedure was that they should pay Dr Al-Naher for the work done and make claims under their policies with HSA for HSA to reimburse them. In doing so, the patients authorised the release of their medical records to HSA to enable it to understand and assess their claims for reimbursement. Dr Al-Naher certified that their claims were proper in each case and supplied the relevant medical records to HSA.

The qualified dental assessors engaged by the HSA to scrutinise the claims became concerned that they may have been made improperly, and in particular that the dental work for which payment was claimed from HSA had in some cases not in fact been carried out by Dr Al-Naher, so that the claims appeared to be fraudulent.

By a letter dated 10 April 2008 from Mr Lynn, one of HSA’s assessors, he informed the GDC about his concerns in this regard in relation to claims for reimbursement by the Second Interested Party (“Mr Dikir”). Mr Lynn did not at this stage provide the GDC with the dental records of Mr Dikir, but did enclose copies of the claim forms and the receipts purporting to show that Mr Dikir had paid Dr Al-Naher for his treatment.

By letters dated 31 January 2009 and 14 July 2009, another of HSA’s assessors, Mr Cavanagh, informed the GDC about further concerns in relation to reimbursement claimed by a further thirteen patients. He enclosed the relevant patient records, with the names disclosed in five cases and in anonymised form in the other eight cases (the difference in treatment appears to have reflected a judgment by HSA about its obligations under the DPA in relation to each patient). Mr Cavanagh’s complaints included allegations that claims had been made (and certified by Dr Al-Naher) for treatment which had not in fact been provided, general complaints about the quality of the treatment provided in some cases and complaints about the nature of the records kept by Dr Al-Naher.

By letter dated 18 August 2008, the GDC wrote to Mr Dikir to ask for his consent to the release of his dental records to the GDC. Mr Dikir wrote back refusing his consent. He reiterated his position on 22 August 2008.

On 1 July 2009 (the reason for the delay did not appear from the evidence before me) the GDC wrote to the HSA to require it to produce Mr Dikir’s dental records in its hands, relying on its power under section 33B of the 1984 Act. HSA then supplied those of Mr Dikir’s dental records which it had in its possession to the GDC.

On 12 April 2010 (again, the reason for the delay did not appear from the evidence), relying on section 33B of the 1984 Act, the GDC requested the names and contact details for all thirteen patients referred to in Mr Cavanagh’s letters to allow it to seek consent from those patients for the GDC to obtain and use their full dental records. HSA then provided such information by means of providing the unredacted versions of all the dental records relating to those patients which it had in its possession.

By letters dated 7 or 8 June 2010, the GDC wrote to each of those thirteen patients to request their consent to the disclosure of their dental records to the GDC (presumably this was intended to be a reference to their full dental records, as held by Dr Al-Naher, since the GDC had already received from HSA such copies of their dental records as were in its possession). In the letters, the GDC stated:

“If you do not consent to the disclosure of your dental records or do not respond to this letter then the Council will apply to the High Court for an order permitting the disclosure and use of your dental records in connection with the Council’s fitness to practise procedures. As part of this process your records may be reviewed by the legal teams of both the Council and the registrant and any independent experts. If the matter proceeds to a hearing before one of the Council’s Practice Committees then your records may be used at that hearing which may be open to the public. However, there will be no reference to your name during the course of the proceedings as it will be anonymised to, for example, ‘Patient A’.”

After further correspondence, the position has been arrived at that ten of the patients (including Mr Dikir) have written to refuse their consent and a further four have not responded. It may be that the GDC’s letters did not reach them, due to changes in address.

Meanwhile, Dr Al-Naher’s solicitors engaged in correspondence with the GDC, objecting to the GDC’s proposal to use the patient records it already held (as provided by HSA) for the purposes of referring complaints against Dr Al-Naher to the Investigating Committee.

For that reason, and because of what it had said to patients in its letters of 7 and 8 June 2010, the GDC issued these proceedings to claim a declaration that it is entitled to use the patient records in its hands for the purposes of investigation by the Investigating Committee and, if so decided, for a hearing before a Practice Committee. The GDC also wishes to use these proceedings to clarify its rights in relation to using patient records in its hands for the purposes of impairment of fitness to practise proceedings against registered dentists. The GDC wishes to establish that it may do so, even if a patient objects, without having to come to court to get an order permitting it to do so. Dr Al-Naher disputes all this, as does Mr Dikir, who made submissions in writing to object to what the GDC is proposing.

Section 33B and the way in which the GDC obtained the patient records

Although in his skeleton argument Mr Winter indicated that he would not advance arguments (which had been canvassed in correspondence) to the effect that the GDC had acquired the patient records from HSA unlawfully, at the hearing he retreated from that position and I permitted him to make submissions to this effect. Mr Winter submitted that the GDC acted unlawfully by requiring HSA to provide patient records to it under section 33B of the 1984 Act. He said that the only proper and lawful course available to the GDC, if it wished to obtain and use patient records, is to seek the consent of the patient in question and, if it is given, to arrange for the patient to require his dentist to hand over his dental records to the GDC, and if it is not given, to apply to the county court pursuant to section 33B(7)-(8) for an order against the patient requiring him to hand over (or instruct his dentist to hand over) his dental records to the GDC. On the basis of this contention, Mr Winter submitted that the way in which the GDC had obtained patient records from HSA by purporting to exercise its powers under section 33B was unlawful, with the consequence that the GDC could not show that its interferences with the patients’ rights to respect for their private lives under Article 8(1), either in the past (by purporting to use its statutory power to obtain patient records from HSA) or as proposed for the future (by passing their dental records on to a widening circle of people within the GDC) was “in accordance with the law” as required by Article 8(2). Accordingly, such interferences were unlawful, by virtue of the duty on the GDC under section 6(1) of the HRA to act compatibly with Convention rights. He also made a subsidiary submission, that section 33B(3) (“Nothing in this section shall require or permit any disclosure of information which is prohibited by any relevant enactment”) was apt to include circumstances in which the GDC is prohibited by a relevant enactment from seeking disclosure, as well as circumstances where the person who is subject to a direction by the GDC under section 33B(2) is prohibited by a relevant enactment from providing information.

I do not accept these submissions. In my view, section 33B(2) is entirely clear in its effect. It allows the GDC to impose a requirement on “any person (except the person in respect of whom the information or document is sought)” (emphasis added) to supply information or “any document in his custody or under his control which appears to the Council relevant to the discharge of those functions” (emphasis added). This provision plainly gave power to the GDC to require HSA to provide further information and patient records as it did. There is no restriction on the powers of the GDC as was suggested by Mr Winter. Section 33B(7)-(8) does not operate to impose a restriction on the power of the GDC to require the supply of information or documents under section 33B; rather, it supplies machinery which enables the GDC to obtain a court order to back up and enforce a requirement imposed by the GDC under section 33B, e.g. if the person who is subject to that requirement is disposed to dispute it for some reason (HSA did not seek to do so, and so it was unnecessary for this machinery to be put into operation).

Once this principal submission by Mr Winter falls away, there is no basis for any suggestion that the GDC acted in breach of its obligations under Article 8 and section 6(1) of the HRA in exercising its powers under section 33B in relation to HSA in this case, and hence no basis for suggesting that the GDC is now to be treated as disabled from arranging for the registrar to pass on the patient records in his hands to the Investigating Committee by reason of the way in which they were obtained from HSA.

Section 33B(3) adds nothing to Mr Winter’s contentions. In view of the submission made by him, I should make it clear that I think that the proper interpretation of section 33B(3) is that it refers to any prohibition in a relevant enactment which operates upon the person who is required by the GDC under section 33B(2) to supply information or documents, and does not refer to any statutory impediment which might prevent the GDC from seeking to impose such a requirement. That is the natural meaning of the words used. The provision serves an obvious purpose in making it clear that nothing that the GDC does in seeking to impose a requirement under section 33B can override any statutory prohibition against supplying information or documents which binds the person who has such information or documents (as distinct from being able to override, e.g., common law obligations of confidentiality). In the context of the present case, however, this point on the interpretation of section 33B(3) does not matter much, since if the GDC had (contrary to my view) acted unlawfully itself in seeking to use its powers under section 33B(2) against HSA, Dr Al-Naher could have sought to maintain his argument based on Article 8 and the way in which the GDC obtained patient records from HSA by reference to that unlawfulness in any event.

Before turning to other submissions, I should draw attention to two puzzling features of section 33B:

The proposed use of the patient records within the GDC

The patient records obtained from HSA relating to the allegations of impairment of fitness to practise levelled against Dr Al-Naher (including that he has dishonestly participated in a scheme to defraud HSA) are currently in the possession of the GDC’s registrar and his staff. The registrar wishes to pass them to the Investigating Committee to enable it to investigate the allegations against Dr Al-Naher. This will involve disclosure of the information in the patient records to a wider circle of people (the members of the Investigating Committee). In due course, the Investigating Committee may well wish to pass the patient records to a Practice Committee for the purposes of investigation and a hearing. This would again involve disclosure of the information in the patient records to a yet wider circle of people (members of the Practice Committee and also legal representatives and, possibly, expert witnesses who are involved in any hearing at that stage).

There are three legal regimes which are relevant to the use which the GDC now proposes to make of the patient records in the registrar’s hands: (i) confidentiality obligations imposed by the common law; (ii) the DPA regime; and (iii) general public law to which the GDC, as a public authority, is subject (in particular, by reference to its obligations under section 6(1) of the HRA and the Convention rights). I address these in turn.

In accordance with well known principles (see, e.g., Coco v A.N. Clarke Engineers Ltd [1969] RPC 41, 47; AG v Guardian Newspapers Ltd (No. 2) [1990] 1 AC 109, 281), the registrar and his staff are subject to common law (equitable) obligations of confidentiality in respect of the patient records, which arise by reason of the obviously private nature of the information in them and the manner in which and purpose for which they came into the GDC’s hands. Such common law obligations are qualified, and permit disclosure where that is necessary to safeguard some important public interest, including to expose fraud or matters which are “medically dangerous to the public” (Beloff v Pressdram Ltd [1973] 1 All ER 241, 260; AG v Guardian Newspapers Ltd (No. 2) [1990] 1 AC 109, 282-283).

It is not necessary to take up time analysing this qualification in detail, since the common law confidentiality obligations are in any event overridden by statutory provisions in the present context. In my view it is clear by implication that the obligation on the registrar under section 27(5)(a) to refer an allegation to the Investigating Committee (which referral triggers an obligation on the Investigating Committee under section 27A(1) to investigate the allegation) includes an obligation to refer all evidential material relevant to the allegation to the Investigating Committee as well. That includes the patient records in this case. There is no requirement under this regime for the registrar first to obtain an order of the court before passing such records on to the Investigating Committee.

It should also be observed that Rule 4(2)(b) of the Rules requires (and hence implicitly authorises) the registrar to send a copy of the documents in his possession which relate to an allegation to the person making the allegation and to the respondent to the allegation. There does not appear to be a difficulty with confidentiality in relation to this requirement in the present case, since both HSA and Dr Al-Naher already have knowledge of the relevant patient records. But it may be noted that in other cases an issue could arise - e.g. if, in the present case, one of the patients had made the relevant allegation, it might have been said that the registrar would have been obliged under Rule 4(2)(b) to send him all the patient records (as being sufficiently related to his allegation), and not just his own records. In such a situation, it would be relevant to consider the proper interpretation and operation of the Rule in the light of sections 3 and 6 of the HRA (see below).

The members of the Investigating Committee who receive the patient records will also take them subject to common law duties of confidentiality owed to the patients and dentist in question, by application of the same general principles (I was also informed that members sign contracts with the GDC containing confidentiality obligations and that the GDC’s Code of Conduct, applicable to GDC members and persons serving on committees of the GDC, emphasises that they are subject to obligations of confidentiality, all of which reinforces their general common law obligations). Members of the Investigating Committee could not lawfully use the patient records for some private purpose of their own, nor disclose them other than for the purposes of carrying out functions of the Committee.

The Investigating Committee will, if it determines that the allegation ought to be considered by a Practice Committee, be under an obligation to refer the allegation to such Committee, under section 27A(4)(a) (triggering, in turn, an obligation on the Practice Committee under section 27B(1) to investigate the allegation). Again, it is clear that the obligation under section 27A(4)(a) includes by implication an obligation to refer all evidential material relevant to the allegation to the Practice Committee, to enable it to carry out its investigation. Again, there would be no requirement under this regime for the GDC first to seek an order of the court before the Investigating Committee proceeds to do this.

The members of the Practice Committee who receive the patient records will be subject to common law obligations of confidentiality in relation to them (reinforced by confidentiality clauses in agreements with the GDC which they enter into and by the GDC’s Code of Conduct). They will only be entitled to disclose such records to others (e.g. the person who is the subject of an allegation under investigation, the lawyers instructed on both sides to conduct the hearing before the Practice Committee and expert witnesses giving evidence at that hearing) to the extent necessary to enable the Committee to carry out its function of investigating, in a proper and fair manner, whether the allegations of impairment of fitness to practise are made out. In my view, this qualification to the obligations of confidentiality owed by Practice Committee members is implied at common law; but in any event statutory authority is given to the Practice Committee to make use of the patient records in this way by implication from the obligation on the Committee under section 27B(1) of the 1984 Act to investigate an allegation. Again, there would be no requirement under this regime for the GDC first to seek an order of the court before a Practice Committee proceeds to do this.

Practice Committees have discretionary powers to regulate how hearings before them are conducted. In exercising those powers, such Committees will need to be alert to safeguarding patient confidentiality, taking care to ensure that confidential medical information relating to identified individuals is not released into the public domain unless absolutely necessary for some exceptional reason. This requirement is strongly reinforced by the obligations on the GDC and its Practice Committees under the HRA: a breach of Article 8 was found in Z v Finland (1998) 25 EHRR 371 arising from unnecessary disclosure of private medical information in the judgment of a court (see para. [113]). It appears from the letters sent to the patients in this case (see para. [29] above) that the GDC is aware of this requirement, and seeks to ensure that patient information put in the public domain at an open hearing will be anonymised.

So far as common law obligations of confidentiality are concerned, therefore, and subject to the issues arising under section 3(1) of the HRA discussed below, there is no barrier to the registrar of the GDC passing on the patient records in this case to the Investigating Committee and there would be no barrier to the Investigating Committee passing on those records to the relevant Practice Committee (if it is determined that the allegations ought to be referred to the Practice Committee).

The fact that the patients in question object to the disclosure, or do not consent to it, does not affect this position. The reason that the GDC is given statutory authority to make use of patient records in this way is because the public interest in investigation of allegations against dentists and other medical practitioners of impairment of fitness to practise has been assessed by Parliament (and by the courts, under the common law) to be so strong as to override private interests of patients in preserving confidentiality, to the extent necessary for the investigation to take place. Where the GDC proposes to make use of patient records in this way, contrary to the wishes of the patients in question, then – so far as the common law regime is concerned - it will usually be a matter of good practice (albeit not a legal obligation) to inform the patients in advance about what the GDC proposes to do with their records, so that they have an opportunity to consider whether to make objections to that course and if need be apply to court to raise such objections (e.g. to say that disclosure of their records is not necessary for the purposes of the investigation to be carried out): compare Woolgar v Chief Constable of Sussex Police [2000] 1 WLR 25, 36H-37B per Kennedy LJ. Arguably, when one turns to the public law/HRA regime, some attempt at getting in touch with the patients concerned to let them know that it is proposed that their records should be used for the purposes of professional misconduct proceedings may be a matter of obligation (absent circumstances which would make it impracticable or unduly harmful to the public interest to do so) to ensure that the interference with patients’ Article 8 rights is “necessary in a democratic society” and kept within proportionate bounds: see paras. [63]-[65] below. In substance, the GDC has done that in the present case. I am also told that it is now their practice to do so in all cases.

Subject to issues under the HRA, reviewed below, it was not suggested that there is any difficulty for the GDC in relation to passing the patient records from registrar to Investigating Committee to Practice Committee (if judged appropriate) arising from operation of the DPA regime. Although the patient records constitute sensitive personal data, the processing of them involved in passing them from the registrar to the Investigating Committee to a Practice Committee in accordance with the statutory provisions referred to above will be justified under both Schedule 2 and Schedule 3 to the DPA: see paras. [20]-[21] above.

I turn, then, to the operation of the public law/HRA regime, which is in my view at the heart of this case. The Strasbourg and domestic authorities make it clear that strong obligations of confidentiality will arise under Article 8 where a public authority has patient records in its hands, placing significant limits upon the extent to which it may disclose such records. Each additional disclosure of patient records in non-anonymised form, as is proposed here, will involve an interference with the patient’s right of respect for his private life under Article 8(1), as more and more people are informed about the personal information contained in those records (first, the members of the Investigating Committee, then the members of the Practice Committee and lawyers and experts appearing at any hearing before them). Such disclosures will therefore require to be justified under Article 8(2).

If a particular act of disclosure cannot be justified under Article 8(2), a breach of Article 8 would occur if it took place. Such a situation would give rise to questions under sections 3 and 6 of the HRA whether such act of disclosure would, because of its incompatibility with Article 8, be unlawful. Mr Havers accepted (and in my opinion he was right to do so) that, if such a situation arose, it would be “possible” under section 3(1) of the HRA to read and give effect to the relevant statutory provisions in the 1984 Act (in particular, sections 27(5)(a) and 27A(4)(a)) in such a way that they would not authorise that particular act of disclosure. In other words, those statutory provisions would fall to be read subject to any Article 8 rights of the patients in question preventing disclosure. That would mean that, in such a situation, the GDC and its organs would be subject to an obligation under section 6(1) of the HRA (not affected by anything in section 6(2)) to act compatibly with the Convention rights in question, and would be prohibited from disclosing the patient records which were in issue.

Furthermore, I consider that, since the provisions in the 1984 Act fall to be read as qualified by Article 8 rights, the personal obligations of confidentiality imposed by the common law on the GDC, the registrar and individual committee members and others with respect to patient records would not be overridden by any statutory authority in a case where disclosure would involve a breach of Article 8 (cf paras. [41] and [43]-[46] above). I also consider that there would be no implied authorisation under the common law itself for disclosure in such a case, on the basis that the extent of the public interest in disclosure would be treated as being informed by the statutory position governing the same circumstances, and hence as limited by reference to Article 8 concerns (cf para. [40] above). The net effect, therefore, in a case in which disclosure of patient records by the registrar (or a member of his office) or by an individual committee member would involve a breach of patients’ rights under Article 8, is that that individual would be personally liable for breach of confidence (as well as the GDC being liable). This is of significance when one comes to analyse whether disclosure of the patient records in this case to the Investigating Committee and to the Practice Committee would comply with the requirements of Article 8.

It should also be noted that in relation to a proposed disclosure by the registrar to other persons pursuant to Rule 4 of the Rules, the first question would be whether it was “possible” for that rule to be read subject to the operation of Convention rights. Very probably it could, just as it is “possible” for the similar provisions in the 1984 Act itself to be read down in that way. But even if Rule 4 could not be read down, the duty under section 6(1) of the HRA would still apply, since the Rules are not primary legislation and there is no suggestion that the Rules are in that special category of subordinate legislation which attracts the operation of section 6(2) of the HRA.

It follows from all this that the resolution of the present case depends directly upon the operation of Article 8 in this context.

The leading Strasbourg authority regarding one public authority transmitting confidential patient records to another public authority to enable the second authority to carry out functions in the public interest is MS v Sweden (1999) 28 EHRR 313. In 1981 the applicant slipped and fell at work, and, since she was pregnant, she consulted a doctor at a women’s clinic. She had difficulty in resuming work and claimed statutory compensation in respect of her injury from the Social Insurance Office (“the Office”). In the course of examining her claim the Office requested her medical records from the clinic, which was under a statutory obligation to provide such records when requested by the Office. The clinic supplied the applicant’s medical records for the period up to 1986 to the Office without telling the applicant. Neither the clinic nor the Office sought the sanction of a court for proceeding in this way. The records included details of an abortion she had had in 1985 as a result of a spinal condition from which she suffered. The Office rejected her claim for compensation on the basis that her sick leave had not been caused by industrial injury. The applicant’s complaint that the disclosure of her medical records to the Office constituted an unjustified interference with her right to respect for private life under Article 8 was rejected by the ECtHR.

The ECtHR held that the disclosure of the applicant’s medical records to a wider group of public servants at the Office constituted an interference with her right to respect for her private life under Article 8(1): para. [35]. The ECtHR held that the statutory regime providing for supply of information to the Office upon request provided a legal basis for the disclosure which was foreseeable in its effect, and that the “in accordance with the law” requirement in Article 8(2) was therefore satisfied: para. [37]. The disclosure pursued a legitimate aim within Article 8(2) (protecting the economic well-being of the country). The Court then turned to consider whether the interference was “necessary in a democratic society”. At paras. [41]-[44] it gave its unanimous ruling in these terms:

“41.

The Court reiterates that the protection of personal data, particularly medical data, is of fundamental importance to a person's enjoyment of his or her right to respect for private and family life as guaranteed by Article 8 of the Convention. Respecting the confidentiality of health data is a vital principle in the legal systems of all the Contracting Parties to the Convention. It is crucial not only to respect the sense of privacy of a patient but also to preserve his or her confidence in the medical profession and in the health services in general. The domestic law must afford appropriate safeguards to prevent any such communication or disclosure of personal health data as may be inconsistent with the guarantees in Article 8 of the Convention. Bearing in mind the above considerations and the margin of appreciation enjoyed by the State in this area, the Court will examine whether, in the light of the case as a whole, the reasons adduced to justify the interference were relevant and sufficient and whether the measure was proportionate to the legitimate aim pursued.

42.

Turning to the particular circumstances, the Court notes that the applicant's medical data were communicated by one public institution to another in the context of an assessment of whether she satisfied the legal conditions for obtaining a benefit which she herself had requested. It recognises that, in deciding whether to accept the applicant's compensation claim, the Office had a legitimate need to check information received from her against data in the possession of the clinic. In the absence of objective information from an independent source, it would have been difficult for the Office to determine whether the claim was well founded. That claim concerned a back injury which she had allegedly suffered in 1981 and all the medical records produced by the clinic to the Office, including those concerning her abortion in 1985 and the treatment thereafter, contained information relevant to the applicant's back problems. As appears from the records of 1985, her back pains constituted the main reason for the termination of pregnancy. Moreover, the data covered the period in respect of which she claimed compensation under the Insurance Act. In the Court's view, the applicant has not substantiated her allegation that the clinic could not reasonably have considered her post-1981 medical records to be material to the Office's decision.

43.

In addition, under the relevant law it is a condition for imparting the data concerned that the Office has made a request and that the information be of importance for its application of the Insurance Act. Staff of the clinic could incur civil and/or criminal liability had they failed to observe these conditions. The Office, as the receiver of the information, was under a similar duty to treat the data as confidential, subject to similar rules and safeguards as the clinic. In the circumstances the contested measure was therefore subject to important limitations and was accompanied by effective and adequate safeguards against abuse.

44.

Having regard to the foregoing, the Court considers that there were relevant and sufficient reasons for the communication of the applicant's medical records by the clinic to the Office and that the measure was not disproportionate to the legitimate aim pursued. Accordingly, it concludes that there has been no violation of the applicant's right to respect for private life, as guaranteed by Article 8 of the Convention.”

In my judgment, similar reasoning is applicable to the proposed disclosure within the GDC (from registrar to Investigating Committee to Practice Committee) in this case:

Against all this, Mr Winter submitted that I am bound by the judgment of the Court of Appeal in A Health Authority v X to hold that it is necessary for a court order to be sought by the GDC before the patient records in this case could be passed on by the registrar to the Investigating Committee and beyond. I do not accept this submission.

A Health Authority v X concerned certain confidential information contained in, inter alia, medical practitioner notes regarding the treatment of patients which the health authority wished to use for the purposes of investigating whether the medical practitioner had properly complied with the terms of his service for the health authority or had been guilty of professional malpractice. The medical practitioner had an obligation under regulations to send records to the health authority when requested to do so, but two patients refused to give their consent to the provision of their records to the health authority. The health authority applied to court for guidance and for disclosure of the documents. At first instance, Munby J followed the Strasbourg judgments in MS v Sweden and Z v Finland and held that the interference with a person’s right to respect for their private life under Article 8(1) would only be justified if there were effective and adequate safeguards against abuse: see [2001] 2 FCR 634 at [53]-[56] and [70]-[71]. The health authority suggested that it was entitled to demand production of the patient records to use them for any purpose the authority might choose, but Munby J held that that would not be compatible with the patients’ Convention rights (see [71]) and that conditions should be imposed in the order to be made requiring disclosure of the records to ensure that there were proper safeguards in place regarding their use (see [74]-[76]). The particular condition he imposed in relation to the patient records was that:

“Save with the prior leave of this court the Authority shall not disclose any of the documents or communicate any information contained in them to any person other than (a) to a medical discipline committee or the National Health Service Tribunal or the General Medical Council and (b) in accordance with regulations 4 and 5 of The National Health Service (Service Committees and Tribunal) Regulations 1992 …” [Emphasis supplied]

Three comments should be made about this aspect of Munby J’s judgment and order: (i) he did not hold or even (as I read his judgment) suggest that an application to the court by the health authority was a necessary precondition for its seeking, obtaining and then making use of the patient records for professional disciplinary or misconduct proceedings against the medical practitioner, in order to secure compliance with the patients’ Article 8 rights (indeed, at [47] he cited with approval a passage from the judgment of Kennedy LJ in Woolgar at [2000] 1 WLR 25 at 36 in which he said “… it seems to me that if the police come into possession of confidential information which, in their reasonable view, in the interests of public health or safety, should be considered by a professional or regulatory body, then the police are free to pass that information to the relevant regulatory body for its consideration” – i.e. without having first to seek an order of the court to permit them to do so); (ii) Munby J’s concern was about the wider claims of the health authority to be entitled to use the patient records for other, unspecified, purposes, and it was to ensure that the authority returned to court to explain in detail for what other uses it proposed to use such records (and with what safeguards) that he imposed the condition set out above; and (iii) the condition was specifically framed to make it clear that in the case of proposed use of the patient records for investigation (either by the health authority or by other official bodies) of allegations of professional misconduct or improper practice by a medical practitioner it would not be necessary for a court order to be sought before the records were passed on. The judgment of Munby J is therefore, on proper analysis, an authority contrary to the submissions made by Mr Winter in this case.

The health authority was unhappy at the limitations imposed on it by the terms of the condition set out above and appealed in relation to that. In its judgment on the appeal, the Court of Appeal did not suggest that Munby J was wrong in any part of his analysis of the position to which I have referred. Quite the contrary. The Court identified that the challenge on appeal was in reality directed to the restrictions in the condition imposed by Munby J (see [2001] EWCA Civ 2014; [2002] 2 All ER 780 at [2]) and proceeded to dismiss the appeal. The health authority submitted that “the National Health Service depended on the free internal exchange of confidential information” and that it “would grind to a halt were Munby J’s judgment extensively construed and applied”: [10]. Mr Pannick QC for the respondent submitted that Munby J had been correct in principle to impose the condition “because the need for patient protection required a decision of a High Court judge to decide the balance between the private/public interest in confidentiality and any competing public interest” and also argued that the imposition of such a condition fell within the ambit of his discretion: [14]. The Court accepted this submission and dismissed the appeal against the imposition of the condition: [25]-[26]. At [25] Thorpe LJ said, “I accept Mr Pannick’s submission that the importance of the resolution of such a conflict requires the independence of a judge”.

I do not think it is possible to read the lead judgment of Thorpe LJ in the Court of Appeal as indicating that a ruling of a court is required before there can be disclosure of patient records (without the consent of the patients concerned) for the purposes of investigation by official regulatory bodies of allegations of professional misconduct or improper practice, such as what is in issue in the present case. If that had been the intention of Thorpe LJ, it would have been necessary for him to embark upon detailed consideration of MS v Sweden and Woolgar to explain why they were wrong or should be distinguished, but there is nothing dealing with these matters in his judgment. On the contrary, he affirmed the condition imposed by Munby J - which made it clear that the intervention of the court was not required in a case where it was proposed to disclose or make use of patient records for the purposes of professional misconduct or improper practice proceedings by appropriate regulatory bodies. As I read the judgment, Thorpe LJ’s observations at [25]-[26] were directed to meeting the contention of the health authority that it could disclose or make use of the patient records for any other purposes which it might choose. It was only if the health authority wished to make such wider disclosure or use of patient records (i.e. beyond disclosure and use for the purposes of professional misconduct or improper practice proceedings), where there was not already in place a clear regime which provided suitable protection for the patients’ interests in confidentiality, that the decision of a court would be required as a safeguard.

As the GDC has used the present application as a vehicle to seek some general guidance about how it may proceed when it wishes to investigate allegations against a dentist of impairment of fitness to practise by reference to confidential patient records in the absence of consent from the patients in question, I think it is appropriate to say something more about whether Article 8 requires the GDC to give notice to those patients about what it is proposing to do with their records. The following comments are somewhat tentative, since I did not have the benefit of detailed argument on the issue; but it is an important matter which the GDC may need to consider in future cases.

In my judgment, it is arguable that the good practice indicated by Kennedy LJ in Woolgar (a case decided on common law principles prior to the coming into effect of the HRA), that in ordinary circumstances the person whose confidential information is in issue should be informed that it is proposed to disclose that information to a professional or regulatory body (see para. [48] above), will be required under Article 8. Against such an argument, it is of course significant that prior notification of disclosure was not said by the ECtHR to be necessary in either MS v Sweden or Z v Finland. On the other hand, there may be scope for development of the law in this area and for a greater focus on the safeguards for patients where confidential medical information about them is to be used for other purposes, particularly where such information may be the subject of intensive scrutiny by others as in this sort of case. In various contexts involving interference with individuals’ Article 8 rights, the ECtHR has held, under the rubric “necessary in a democratic society” in Article 8(2), that procedural obligations may arise requiring the involvement of an individual in some way before a decision is taken to act to interfere with his rights under Article 8(1). For example, in TP and KM v United Kingdom (2002) 34 EHRR 2 (a case involving a decision to take children into care) the ECtHR said, at para. [72], “… the decision-making process involved in measures of interference must be fair and such as to afford due respect to the interests safeguarded by Article 8”; and to similar effect see Chapman v United Kingdom (2001) 33 EHRR 18 at para. [92]. In a context like that in the present case, it can be said (as Kennedy LJ observed in Woolgar) that taking steps to give patients notice that their records are to be used for professional or regulatory proceedings gives them an opportunity to make representations against the public authority making disclosure and to go to court if they feel strongly that disclosure ought not to be made. It might be argued that this would be an additional safeguard for patients which could be effective, while at the same time being less intrusive and generally costly for a body such as the GDC than would be an obligation for it to apply to court itself in every case.

Even if adoption of such a procedure were now, by development of the law under Article 8, to be treated as a legal requirement, it would not in my opinion involve imposing greater burdens on the GDC than they have sought to discharge on the facts of the present case and which they would propose to discharge in future cases by giving such prior notification as a matter of general practice. I think that the obligation, if it exists, would be very much along the lines indicated by Kennedy LJ in Woolgar. The GDC would only have to take reasonable steps to identify and notify the patients concerned. It would not be obliged to do so if that was impracticable (as was probably the position, for example, in General Dental Council v Rimmer, in which the entire computerised records of a medical practice had to be subject to limited electronic interrogation) or undesirable for some reason of the public interest. I do not think that any such possible obligation would have required the GDC in this case to take further steps to try to track down the four patients who did not reply to its letters seeking their consent. In situations where it is not possible to follow such a prior notification procedure, particular care may need to be taken to ensure that the other safeguards in place will be effective to ensure that confidential patient information is only disclosed or made use of for proper purposes.

In the light of this judgment, it may not be necessary to make any formal order or declaration on the GDC’s application. The parties will now have the opportunity to make submissions about that.