Giovanni Marcheselli v The Information Commissioner & Anor

In September 2019 the appellant raised his concern with the General Medical Council (GMC) about the fitness to practise of a doctor alleging that he and his family had been harmed by the doctor’s actions which he said had brought the profession into disrepute. In November 2019 he raised further allegations with the GMC about a second doctor. The GMC decided not to open an investigation into the issues raised by the appellant about either doctor. Those decisions were notified to him on 9 December 2019 and the appellant requested a review of the GMC’s decisions on 23 December 2019 which was referred to the GMC’s review team in accordance with the GMC Rules. In due it was determined after review that a fresh decision was not necessary and the original decision to close the matter would stand. This decision is not about resolving those allegations which were considered by the GMC and responded to within their responsibility as the regulator of medical practitioners in the UK. Nor is this decision about the appellant’s dissatisfaction with the GMC’s decision and its fitness to practise processes or the general system of regulating doctors.

On 23 February 2020 the appellant wrote to the GMC to request information under the Freedom of Information Act 2000 (FOIA). This decision is only about that request and whether the information requested by the appellant should be disclosed to him.

The information requested concerned one of the doctors about whom the appellant had complained in September 2019, that doctor is not named in this decision, which will indicate where their name would have been in any quoted material (Footnote: ¹). The information request read as follows

“Information request RE: [name and GMC no of Dr redacted]

Please provide the following information in respect of this doctor which is not on the

medical register:

1.

Names of Designated body and / or Annual Appraisal Doctor / Responsible

officer for last five years: 2019, 2018, 2017, 2016, 2015

2.

Year or date of last revalidation

3.

Year or date of next revalidation

General queries:

Can a doctor acquire practising privileges at a designated body (non NHS) and then

not actually work there but run his/her own private practice instead?

Would this be regarded as having a 'connection'?

Would the designated body where there are only practising privileges but not any

employment or contracts be regarded as having an appropriate connection for

appraisal and/or revalidation requirements?

Under what circumstances might a psychiatrist have a responsible officer who is not

also a psychiatrist?”

The GMC response was sent on 24 March 2020. As regards questions 1 – 3 in the request the GMC told the appellant that they were withholding the requested information under section 40(2) FOIA as it was the doctor’s personal data. The GMC went on to give an explanation as regards the appellant’s general queries. The GMC asked the appellant to clarify his queries as they indicated that the questions may be based on misunderstandings. Those general queries were the subject of further correspondence but do not form part of this appeal which is concerned with the information requested in questions 1-3.

Revalidation as referred to in questions 2 and 3 of the request, is the process by which the GMC confirms the continuation of a doctor’s licence to practise in the UK. Revalidation is mandatory for doctors who wish to retain their licence to practise. Revalidation involves a yearly appraisal process which will often involve a “Designated Body” and a “Responsible Officer”. A Designated Body is an organisation that assists a doctor with their appraisal and revalidation process; the Responsible Officer at the relevant Designated Body makes the recommendation for the revalidation. If a doctor has a Responsible Officer, they will make a revalidation recommendation to the GMC every five years. Revalidation can also be undertaken in alternative ways, for example through the GMC’s approval process, or via an alternative “suitable person”. Although a doctor may work in more than one place at a given time a doctor can only be attached to one Designated Body at a given time. This does not necessarily indicate that their Designated Body is their sole employer, or their employer at all. It does not even necessarily indicate their physical place of work: for example, many locum agencies are Designated Bodies. Where a doctor has multiple employers, their Designated Body is determined by application of the Medical Profession (Responsible Officer) Regulations 2010 (“the 2010 Regulations”).

The appellant wrote back to the GMC on 2 April 2020 disputing that the information requested in questions 2 and 3 of the request would be personal data and stated that as the information within question 1 had been in the public domain previously the GMC were wrong to rely on s40(2) in that regard.

The GMC not only publishes guidance about the revalidation process but also publishes specific categories of information about doctors and their registrations in the Medical Register which is available to the public on the GMC’s website. There is a publication policy which sets out what information will be published about each registered doctor, this includes the current status of their licence to practise, confirmation of whether they are subject to revalidation, and if so their current Designated Body and Responsible Officer.

The GMC does not publish information once it is no longer current. Thus at the time of the request on 23 February 2020 the information requested in question one of the request was not published.

The GMC has never published the year or dates of doctors’ revalidations as sought in parts 2-3 of the request, nor has it published the names of appraisers other than Responsible Officers as it sees no need to do so, as the publication of such details about a doctor’s career would not assist the public in understanding or scrutinising either the GMC’s discharge of its regulatory functions or the doctor’s fitness to practise and historic data may only provide a partial picture of the doctor’s recent career history. The GMC has a process for handling complaints and comprehensive fitness to practise procedures that operate within a statutory framework but the information requested by the appellant is not relevant to that regime as the public does not need such information should they wish to make a complaint about a doctor or to understand the GMC’s discharge of its statutory function.

The GMC publishes specific categories of information about doctors and their registrations in the Medical Register, available on the GMC’s website. Those categories of information have been selected by the GMC in order to strike the correct and proportionate balance between transparency in respect of doctors’ registrations (and thus this aspect of the GMC’s regulatory functions) and doctors’ rights to privacy. The GMC’s approach is detailed in its Publication and Disclosure Policy. That policy is intended to inform doctors’ reasonable expectations as to what information about them will and will not be made publicly available. That policy was amended in 2016, following a consultation exercise, which was also published.

The appellant requested an internal review on 8 April 2020 noting that the GMC position was that information that is no longer current reacquires a private status but that in his view this was contrary to the revalidation processes’ stated aims of ensuring that doctors are “safe” to practise and reduces transparency.

The result of the internal review was notified to the appellant on 1 July 2020. The GMC maintained its original position that the information requested is the personal data of the named doctor.

The appellant complained to the Information Commissioner on 21 July 2020. Having conducted an initial review the Commissioner indicated that it was the Commissioner’s initial assessment that the exemption provided by s40(2) was properly engaged and invited the appellant to withdraw his complaint. However, he did not withdraw the complaint and requested a formal decision notice which was issued on 26 October 2020, reference IC-47549-W6H0. That decision notice concluded that the GMC is entitled to withhold the information under s40(2) by way of s40(3A)(a).

Section 1 FOIA sets out the duty on a public authority to communicate information requested of it as follows

“(1)

Any person making a request for information to a public authority is entitled—

(a)

to be informed in writing by the public authority whether it holds

information of the description specified in the request, and

(b)

if that is the case, to have that information communicated to him.”

It is to be noted that disclosure made pursuant to s1 FOIA is regarded as made to the world at large and not simply to the requestor.

However, the duty in section 1 does not apply to “exempt information” by virtue of section 2:

“(2)

In respect of any information which is exempt information by virtue of any provision of Part II, section 1(1)(b) does not apply if or to the extent that—

(a)

the information is exempt information by virtue of a provision conferring absolute exemption, or

(b)

in all the circumstances of the case, the public interest in maintaining the exemption outweighs the public interest in disclosing the information.

(3)

For the purposes of this section, the following provisions of Part II (and no others) are to be regarded as conferring absolute exemption—

…

(fa) section 40(2) so far as relating to cases where the first condition referred to in that subsection is satisfied,”

In this case the relevant provision conferring an exemption in Part II of FOIA is section 40 (Footnote: ²) which at the time of the request stated as relevant

“(2)

Any information to which a request for information relates is also exempt information if—

(a)

it constitutes personal data which does not fall within subsection (1), and

(b)

the first, second or third condition below is satisfied.

(3A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act—

(a)

would contravene any of the data protection principles,

…

(3B) The second condition is that the disclosure of the information to a member of the public otherwise than under this Act would contravene Article 21 of the GDPR (general processing: right to object to processing).

(4A) The third condition is that—

(a)

on a request under Article 15(1) of the GDPR (general processing: right of access by the data subject) for access to personal data, the information would be withheld in reliance on provision made by or under section 15, 16 or 26 of, or Schedule 2, 3 or 4 to, the Data Protection Act 2018, or

(b)

on a request under section 45(1)(b) of that Act (law enforcement processing: right of access by the data subject), the information would be withheld in reliance on subsection (4) of that section.”

Personal data is defined in the Data Protection Act 2018 within s3(2) which reads

““Personal data” means any information relating to an identified or identifiable living individual”

The first data protection principle is set out in Article 5(1)(a) of the GDPR, as follows

“Personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject.”

“Fairness” entails balancing the reasonable expectations of the data subject and the damage or distress that disclosure is likely to cause against any countervailing justification for disclosure.

In order for processing to be lawful, one of the reasons listed in Article 6(1) of the GDPR must apply to the processing. The only basis that is potentially applicable in this case is Article 6(1)(f), which sets out that

“..processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data…”

There is a three-part test that must be satisfied if Article 6(1)(f) is to be regarded as the lawful basis for processing the data. That three part test is as follows

Guidance has been given in caselaw as to the approach that is to be taken to the application of the three part test and although that arose under a previous provision that is equivalent to Article 6(1)(f), and thus the rulings of the Upper Tribunal remain relevant and binding on the First Tier Tribunal.

The primary case to be considered is Goldsmith International Business School v Information Commissioner and Home Office [2014] UKUT 563 (AAC). A “reasonable expectation of privacy” is central to the engagement of an individual’s rights under Article 8 of the European Convention on Human Rights (“ECHR”). The analysis of fairness and of condition 6(1)(f) will therefore be applied in accordance with ECHR principles of proportionality meaning that disclosure can only take place if it would be reasonably necessary for the purposes of a “pressing social need” and it must be the least intrusive way of achieving that aim.

We were also referred the decision of the Upper Tribunal in Information Commissioner v Rodriguez-Noza and Foster [2015] UKUT 449 (AAC) which applied the dicta of the courts and states

“The first stage is to consider whether the processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data would be disclosed. If not, it is not necessary to proceed to the other stages. That is what I decided in Farrand at [29].

The second stage only arises if the consideration passes the first stage. It is then necessary to identify the rights and freedoms or legitimate interests of the data subject. If there are none, it is not necessary to proceed to the third stage.

The third stage only arises if the consideration passes the first and second stages. It is then necessary to consider whether the processing is unwarranted, or overridden, in any particular case by reason of prejudice to the data subject’s rights, freedoms or legitimate interests.”

In DB v GMC [2018] EWCA Civ 14978, the Court of Appeal confirmed that data controllers are best placed to make decisions about how that balance should be struck in their particular context. That is not to say that the Tribunal is bound by the decision of the data controller but that weight to the GMC’s assessment of how the balance is struck and a good reason would be needed to overturn that assessment as regards the disclosure of personal data.

The appellant lodged his notice of appeal against the decision notice on 20 November 2020. The remedy sought by the appellant was the disclosure of the requested information.

The appellant requested a paper determination of his appeal and no other party requested an oral hearing. Given the issues and receipt of written submissions from all three parties that set out and developed their respective cases and response to each others points, we decided it was fair and just to determine the appeal on the papers.

The grounds of appeal run to just over 4 pages and was accurately summarised as follows by the first respondent in their response into four key points

“1)

When assessing the legitimate interests element, the DN erroneously discounts information on the basis that it refers to a ‘second doctor’. The Appellant explains that there is only one doctor at issue, which is the named doctor.

2)

When considering the necessity element, allowing the revalidation history of the named doctor to be withheld means that the revalidation history of all doctors could be withheld. This means that the Appellant’s “more general concerns cannot ever be addressed”. The Appellant’s view is that this information should be available in respect of all doctors.

3)

In respect of the necessity element, the public needs to have access to doctors’ history of connection to various Designated Bodies and Responsible Officers because this can reveal safety issues. In addition, the Appellant’s experience shows that the entries in the publicly available information may be inaccurate.

4)

When considering the balance of interests test, the Commissioner incorrectly records the detail of some of the Medical Profession (Responsible Officer) Regulations 2010. In addition, Sir Keith Pearson has provided a review that highlights some weaknesses in the current revalidation process. All of this indicates that a doctor’s connection and disconnection history is a matter of public concern. The public needs this information in order to have confidence in the system. Disclosure of this information will add to patient safety. Any distress to the doctor would be outweighed by these matters”

The Information Commissioner responded to the appeal on 20 January 2021. The Commissioner invited the tribunal to uphold the decision notice and dismiss the appeal. From the response and later written submissions the case for the Information Commissioner and their core submissions can be summarised as follows

Having been joined to the proceedings by the Registrar on 23 December 2020, the GMC responded to the appeal in a document served on 3 February 2021. The case for the GMC as set out in their response and later submissions can be summarised as follows

In his reply and later submissions the appellant added to his submissions in his grounds of appeal. We have read and considered all the submissions he has made even if not specifically referred to in this document as they run to many pages. This is a summary of the relevant submissions to the central issues in the case

When a person requests information from a public authority there is a duty on that authority under section 1(1) FOIA to communicate that information to the requestor (and thereby to the world) unless it is exempt information within the other provisions of that act. The possible exemption at issue in this case is the application of section 40 which concerns personal data. Personal data is defined as any information relating to an identified or identifiable living individual.

The request asked for the named doctor’s designated body, annual appraisal doctor, responsible officer from 2015-19 and the dates of his revalidation. We have concluded that all of the information requested by the appellant in the three questions that made up his request is personal data. That is because it relates to a living individual and when coupled with other information (in this case, the terms of the Request) that individual is clearly identifiable from and in relation to it. It does not matter for these purposes that the information is “procedural or formulaic” because it relates to the named doctor in the way required by the legislation.

We then turned to consider whether the disclosure of the information to the appellant otherwise than under FOIA would contravene any of the data protection principles. In doing so we were focussed on the application of s40(3A)(a), “the first condition”, which was the condition relied upon in the decision notice at issue.

By virtue of the first data protection principle set out in Article 5(1)(a) of the GDPR, personal data must be processed lawfully, fairly and transparently in relation to the data subject. The data subject in this case is the named doctor. The processing with which we are concerned is the potential disclosure of that personal data to the appellant, and the public at large.

In order to be lawful in the context of this case, Article 6(1)(f) of the GDPR must apply to the processing. We have applied the three part test, each section of which must be satisfied if there is to be a lawful basis for the processing. That three part test is as follows

In the application of the three part test we have concluded, as did the Information Commissioner in the decision notice that only the first part of the test is satisfied.

We accept that there are legitimate interests in transparency, concerns about the doctor’s safety and concerns about the GMC’s revalidation process. Members of the public, have a legitimate interest in transparency about the GMC’s discharge of its regulatory functions, including oversight of the suitability and fitness to practise of registrant doctors. That is not to say that we have concluded that, in this case, any of those concerns are well founded, as explained above this decision is not concerned with resolving the appellant’s concerns on these issues.

We considered the point raised by the appellant that a factual error in the decision notice about a second doctor who the appellant states does not exist. Whether or not there is a second doctor is immaterial to the analysis we have undertaken about the legitimate interests at stake. The nature of those interests is unchanged whether or not there is a second named doctor. There is no dispute in this case about the nature of the legitimate interests that engage the first part of the three part test.

However, the processing (disclosure) is not necessary because it would not further any legitimate interest. The appellant’s case is that the registration history of the named doctor would reveal safety issues for patients. He has two arguments first, the pattern of changes between Designated Bodies would reveal safety issues, and second, errors in previous entries would show safety issues. However, the information he requests is procedural and formulaic and at most would reveal only the variety in the doctor’s career which of itself in not capable of properly founding any inference about the safety of their practice. Whether or not a doctor has had a varied career, of itself, says nothing about their fitness to practise, safety or competence. No negative inferences could reasonably be drawn from a doctor changing their Designated Body. Similarly, if there are errors in the information this will reveal nothing about such legitimate interests.Errors in revalidation entries, for example due to a doctor misinterpreting the application of the 2010 Regulations, are not indicative of safety concerns

The requested personal data would not further the legitimate interests because there is no connection between the legitimate interests on which the appellant relies and the personal data he seeks. Even if disclosure of this personal data were connected to any such legitimate interests, it would not be reasonably necessary for the furtherance of those interests. Such information would not help individuals explore or take further any concerns they may have about particular doctors, and it would not help them scrutinise the GMC’s discharge of its regulatory functions. Such objectives can be taken forward without the information requested via the external complaints process and the statutory appeals/review processes or indeed the remedy of judicial review. Furthermore the current information about doctors is published which enables the timely making of complaints about practitioners. The disclosure of this personal data would not serve a legitimate interest and thus the necessity test is not satisfied.

Even though we have concluded that the second part of the test is not satisfied and this would suffice to dispose of the point we have gone on to consider the third aspect in the event we are in error on that point.

The third part of the test requires the balancing of the legitimate interests in the processing against the legitimate interest(s) or fundamental rights and freedoms of the data subject, in this case the named doctor. We have decided that the processing is unwarranted, or overridden, in this case by reason of prejudice to the data subject’s rights, freedoms and legitimate interests. That is because

To the extent there is a need to consider the named doctor’s rights under Article 8 ECHR we have concluded that the disclosure of this data would be unlawful because

We considered whether there was a distinction to be drawn between the information requested in question 1 that had previously been published and that requested in parts 2 and 3 which had never been published by the GMC. We noted that at the time of the request none of the information was published and thus it could be argued that the distinction proposed is illusory. However, we do not find it necessary to determine that point given that we have accepted and give weight to the carefully considered GMC policy decision, as the statutory regulator, that the protection of the public does not require the publication of historic data but only current data. The data is lawfully processed by being held in order to facilitate the GMC’s regulatory function in case of any future complaint. Processing by way of disclosure of any of the information sought is not necessary to protect the public nor allow performance of the regulatory functions of the GMC.

As neither the second or third part of the three part test is satisfied the processing of the named doctor’s personal data by disclosure as requested under FOIA would not be lawful because none of the reasons listed in Article 6(1) applies to the processing. Thus such processing would contravene the first data protection principle set out in Article 5(1)(a) of the GDPR, (see section 40(3A)(a) FOIA) and therefore it is exempt pursuant to section 40(2) FOIA.

We make it clear that for the reasons set out above we have also concluded that the processing would be unfair in relation to the named doctor as data subject. This also amounts to a contravention of the first data protection principle that would engage the exemption.

The requested information is accordingly exempt under section 40(2) FOIA, because it is the personal data of the named doctor, and its disclosure to the public would be unfair and not justified by reference to any lawful processing condition from Article 6(1) GDPR. The Information Commissioner’s analysis of this case, as set out in her decision notice was not in error of law and contained no wrongful exercise of discretion.

For these reasons the appeal is dismissed.

Pursuant to rule 14 of the tribunal rules it is ordered that any matter likely to lead members of the public to identify the doctor about whom the complaint was made shall not be disclosed or published to any third party in relation to these proceedings and no person shall be provided with a copy of the open bundle or any other document or correspondence sent to the tribunal in this appeal without the leave of this tribunal, the Upper Tribunal or a court. This is because the open bundle makes reference to the doctor about whom the complaint was made and I am satisfied such disclosure would be likely to cause that person serious harm; and I am satisfied, having regard to the interests of justice, that it is proportionate to give such a direction.