Dr Sarah Myhill v The Information Commissioner & Anor

This is an appeal, with my permission, against the decision of the First-tier Tribunal (Judge Hazel Oliver, Mr Gareth Jones and Mr Malcolm Clarke) which sat on 22 March 2021 and reached its decision on 6 April 2021.

The Appellant is Dr Sarah Myhill. The First Respondent, who had put in a submission, but did not appear and was not represented, was the Information Commissioner (“the ICO”). The Second Respondent, which was ably represented by Mr Stephen Kosmin of counsel, was the General Medical Council (“the GMC”).

On 7 April 2021 the Tribunal promulgated its decision, by a majority dismissing Dr Myhill’s appeal against a decision notice issued by the ICO on 17 December 2019. That decision notice had held that the GMC had correctly applied s.40(5B)(a)(i) of the Freedom of Information Act 2000 (“FOIA”) in declining to confirm or deny whether it held information constituting an “evidence base” for the GMC’s decision not to investigate a fitness to practice complaint made by Dr Myhill in respect of certain registered medical practitioners on 14 January 2018.

The Tribunal refused Dr Myhill permission to appeal against its decision on 20 October 2021.

On 13 January 2022 I granted Dr Myhill permission to appeal against the decision of the Tribunal.

I made other rulings in the course of the case management in the course of the appeal, although it is not necessary to recite them in this decision (save for what I say in the last paragraph of this decision).

I heard the appeal in Birmingham on the morning of 22 June 2022 and reserved my decision.

As the Tribunal explained in its decision in April of last year

The Tribunal went on to explain that

“17.

The overall issue in this case is whether the GMC was entitled to rely on section 40(5B)(a)(i) FOIA in order to refuse to confirm or deny whether it held the information in the Request. This involves the following issues:

a.

Would confirming or denying that the information is held reveal personal data about third parties?

b.

Is the data controller or third party or parties to whom the data are disclosed pursuing a legitimate interest or interests?

c.

Is disclosure (through confirmation or denial) necessary for the purposes of those interests?

d.

Are such interests overridden by the interests or fundamental rights and freedoms of the data subjects which require the protection of personal data?”

The members of the Tribunal were agreed on the first three questions, but disagreed as to the fourth. With regard to the first three questions it held that

“26.

Would confirming or denying that the information is held reveal personal data about third parties? The requested information clearly contains personal data because it relates to a specific complaint. Confirming or denying whether the GMC holds an evidence base relating to a particular investigation will reveal whether there was a complaint about specific doctors.

27.

The appellant rightly says that she was not asking for any personal information. But, providing the information she was asking for would nevertheless reveal personal data. The GMC cannot answer the appellant’s question about a specific complaint without revealing personal data. Although the wording of the Request itself does not reveal or ask for personal data, the Request must be read in the context of earlier correspondence between the parties which would involve identifying the individuals involved. This correspondence clearly names individual doctors, and also the work with which they were involved, which could also be used to identify them. The Request itself forms part of a longer email which refers to the appellant’s complaint and concerns about how it was dealt with. As put in the Commissioner’s response, confirmation about whether an evidence base exists in relation to a potential investigation into “Doctor X” will be information relating to Doctor X.

28.

The question for the Tribunal is whether the GMC can refuse to confirm or deny that this information is held. The duty to confirm or deny does not apply if doing so would contravene any of the data protection principles. These principles require the doctors’ personal data to be processed lawfully, fairly and transparently.

29.

The GMC has provided some background to its complaints and investigations process. The GMC is the independent regulator for doctors in the UK. It has a statutory function to investigate complaints that a registered person’s fitness to practise is impaired. An investigation into a complaint against a medical practitioner starts with an initial decision by the Registrar as to whether there should be a formal investigation. If not, the matter does not proceed any further. If there is to be a formal investigation, the Registrar refers the complaint to two Case Examiners to decide on what action should be taken. The Case Examiners may refer the matter to the Medical Practitioners Tribunal Service, agree undertakings from the practitioner, issue a warning, or close it with no action. A complainant who is dissatisfied with a decision not to progress a complaint can seek review by the Registrar under rule 12 of the relevant rules. The Registrar can review the decision if there is reason to believe it is materially flawed or there is new information which may have led to a different decision, or if other specific grounds apply (a review is necessary for the protection of the public, to prevent injustice to the practitioner, or otherwise necessary in the public interest). A complainant can also pursue a judicial review.

30.

In order for processing of the doctor’s personal data to be lawful, one of the conditions in the GDPR must apply. The relevant condition here is 6(1)(f) GDPR. We apply the facts to the three questions relevant to this condition as follows.

31.

Is the data controller or third party or parties to whom the data are disclosed pursuing a legitimate interest or interests? The parties agree that the appellant is pursuing legitimate interests.

32.

The appellant argues that the underlying issues behind her request are in the public interest. Her complaint makes serious allegations about fraud, misuse of public money, and harm to patients, which she says the GMC ought to have addressed by investigating further and conducting fitness to practice hearings. She says she is challenging the GMC’s decisions in the public interest.

33.

The Commissioner found in her Decision Notice that the appellant was pursuing legitimate interests - both a general interest in openness and transparency, and the interests involved in her underlying issue which have wider societal implications. The GMC also accepts that the appellant is pursuing legitimate interests, although says that these are limited to general considerations of transparency and accountability.

34.

We agree that the appellant is pursuing legitimate interests by making her request for information. There is a general public interest in openness, transparency and accountability arising from information about the GMC’s complaints process and decision-making. There is also a more specific public interest in the serious matters raised by the appellant in relation to her specific complaint, and how the GMC dealt with that complaint. Unlike in many cases about complaints to the GMC, the appellant is not asking directly for confirmation or denial as to whether information about named doctors is held by the GMC. The appellant knows this information already. However, this information will be revealed to the word at large if the GMC answers her actual request under FOIA. There are legitimate interests behind the Request. Therefore, disclosure of the doctors’ personal data as a result of confirming or denying whether information is held would further these legitimate interests.

35.

Is disclosure (through confirmation or denial) necessary for these legitimate interests? We have assessed this on the basis of the tests set out above, by considering reasonable necessity and whether there are less restrictive means of achieving the legitimate aim in question. General openness, transparency and accountability cannot obviously be achieved by means other than disclosure to the world at large under FOIA. It is more questionable whether there are less restrictive means of addressing the concerns about how the GMC has dealt with the appellant’s specific complaint – given the availability of review by the Registrar and judicial review, and the limited information that is provided by confirmation or denial. However, in the circumstances we accept that confirmation or denial as to whether an evidence base is held is reasonably necessary to the public interest in understanding how the appellant’s complaint was dealt with by the GMC.”

With regard to the fourth question, the majority of the Tribunal held that

“36.

Are those interests overridden by the interests or fundamental rights and freedoms of the data subjects which require protection of personal data? It is clear that doctors have a reasonable expectation that the fact a complaint has been made against them will not be disclosed to the world at large by the GMC. We have seen the GMC’s published publication and disclosure policy. In relation to complaints and investigations, this policy states, “The fact that a doctor is the subject of an investigation will not be routinely disclosed to general enquirers (apart from current or new employers/responsible officers) or the media unless and until a warning is issued, undertakings are agreed or a hearing takes place. The exception to this is where it is necessary for the MPTS to impose an interim order to restrict the doctor’s practice as a precautionary measure.” This policy is consistently followed by the GMC in relation to FOIA requests.

37.

The majority of the Tribunal finds that these interests are overridden by the doctors’ data protection rights, and so confirmation or denial would not be lawful under the DPA and GDPR. Confirming or denying whether information is held about a complaint would cause the doctors distress and upset and constitute a serious intrusion on their privacy. This would be a clear breach of their reasonable expectations of privacy, which arise from the GMC’s published policy. Publication of the fact that a complaint has been made about a named doctor is very likely to cause damage to their professional reputation. The GMC’s publications policy strikes a balance between transparency where action has been taken in relation to a doctor’s fitness to practice
and preserving privacy where a complaint has not resulted in such action. Disclosure of the fact a complaint has been made about a doctor reveals little, if anything, about actual fitness to practice, but is very likely to cause damage and distress to the individual doctor.

38.

We are aware that there has been some public discussion of the underlying issues of concern to the appellant which has potentially disclosed the identity of the doctors involved, both through her own activities and through debates in Parliament. Mr Kosmin submitted that this is likely to increase the distress as the issue is already in the public eye. We do not agree – if anything, this may reduce the damage to professional reputation that would be caused by a confirmation that a complaint had been made to the GMC, as there has been professional and political discussion of the underlying issues. Nevertheless, the doctors still have a
reasonable expectation that the GMC will preserve their privacy in accordance with their published policy. The fact that the appellant has chosen to make some matters public should not reduce the privacy rights of the doctors, or their reasonable expectations that the GMC will comply with its own policy and keep the information confidential.

39.

The Commissioner and the GMC have submitted that the appellant’s legitimate interests in disclosure are very weak, and so easily outweighed by the doctors’ privacy rights. We do not agree and find that the issue is more finely balanced. As explained, there are various legitimate interests in the information requested by the appellant, which is the evidence base for not proceeding to an investigation in response to a complaint to the GMC. This issue is potentially of public importance.

40.

However, the confirmation or denial by the GMC that it holds information of the description specified in the Request will only further these interests to a limited extent. The appellant herself provided a set of detailed evidence to the GMC. She has made wide-ranging allegations about fraud, misuse of public money, and alleged harm to thousands of patients. The GMC sent a ten-page letter to the appellant which explained in detail the reasons for not taking the matter any further. The appellant had the options of a review by the Registrar and judicial review in order to challenge the GMC’s decision. FOIA is not a substitute for these processes,
which are designed to allow scrutiny of the GMC’s decision-making where needed. Confirmation or denial that the GMC holds evidence for its decision not to proceed to an investigation will only further the identified legitimate interests in a limited way – particularly because the appellant herself had provided detailed evidence to the GMC. But, by doing so, the GMC would be confirming or denying that it holds information about complaints about specific doctors. This will clearly breach the privacy rights of those doctors in a way likely to cause distress and reputational damage.

41.

Having considered the matter carefully, the majority of the Tribunal therefore finds that the legitimate interests in disclosure (through confirmation or denial) are overridden by the privacy rights of the doctors which require protection of personal data. The appellant submitted that the GMC was using micro-arguments about data protection to trump macro-arguments about alleged fraud and patient safety. Our role is to balance the legitimate interests in confirmation or denial that the requested information is held against the privacy rights of the doctors. Having done so, we find that the balance weighs in favour of the privacy rights. This is not to diminish the importance of the underlying issues of concern behind the appellant’s complaint to the GMC (although we are making no finding on whether these allegations are correct or not). However, for the reasons explained above, confirmation or denial would clearly breach the doctors’ privacy rights while furthering the legitimate interests behind the Request in only a limited way.”

On that issue, Mr Clarke dissented:

“42.

Malcolm Clarke's minority view is as follows. I completely concur with the conclusions of my colleagues on the procedural issues (Paras 21 to 25) and on the first three tests of the substantive issues (paras 26 to 35). However, on balance (and I agree with the view in paragraph 39 that it is a balanced judgement) I reach a different conclusion on the final limb (Paras 36 to 41) for the following reasons.

43.

The previous cases cited (on two of which I sat), involving requests to the GMC for information relating to complaints against doctors, involve complaints, if they exist, about treatment or advice provided by those doctors to individual named patients. This case is different in that it relates to complaints to the GMC, if they exist, about a published clinical research trial which informed national NICE guidelines.

44.

Evidence given to us showed that the conduct and validity, and therefore the findings, of this trial became the subject of extensive dispute in professional journals and gave rise to two debates in Parliament, in at least one of which one of the doctors was named. Dr Myhill gave evidence, which was not contested by the GMC, that as a result of these debates, the NICE
guidelines were altered.

45.

We have neither the jurisdiction nor the expertise to reach any conclusions on the clinical issues. However, I conclude that Dr Myhill's legitimate interest in seeking this information, if it exists, as a practising doctor with patients, who has a deep professional interest in ensuring that national recommended treatments in this area of medicine are evidence-based, is a very
strong one.

46.

I agree (i) that confirmation or denial that the information is held would reveal personal information about the doctors involved and (ii) that the stance of the GMC to neither confirm nor deny whether information is held is entirely correct in the more usual type of case where a complaint, if it exists, against a doctor about individual treatment is not taken to the next stage.
However, in this case, I think:

a.

Dr. Myhill’s legitimate interest in knowing whether the evidence she requests is held by the GMC, is a very strong one in the context of the wider professional, parliamentary, and public interest in the history of treatment guidance in this area of medicine.

b.

Those professional and political debates will, or should have, altered the doctors' reasonable expectations of privacy.

47.

I therefore conclude that, in this case, the processing of personal data caused by confirmation or denial that the requested information exists would be lawful, fair and transparent, and that, applying Article 6(1)(f) of GDPR, Dr Myhill's legitimate interests are not overridden by the rights and freedoms of the data subjects.

48.

For the avoidance of doubt, I make no assumptions about whether information within the scope of the request is held by the GMC or, if it is, whether any exemptions are engaged.”

The result therefore was that

“49.

The majority decision is that disclosure of the doctors’ personal data would not be lawful
and so would breach one of the data protection principles. The GMC is entitled to refuse to confirm or deny the existence of the requested information under section 40(5B)(a)(i) FOIA. By a majority decision the appeal is dismissed.”

So far as material, FOIA provides that

“1 General right of access to information held by public authorities

(1)

Any person making a request for information to a public authority is entitled—

(a)

to be informed in writing by the public authority whether it holds information of the description specified in the request, and

(b)

if that is the case, to have that information communicated to him.

......

40 Personal information

(1)

Any information to which a request for information relates is exempt information if it constitutes personal data of which the applicant is the data subject.

(2)

Any information to which a request for information relates is also exempt information if –

(a)

it constitutes personal data which do not fall within subsection (1), and

(b)

the first, second or third condition below is satisfied.

(3A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act would contravene –

(a)

any of the data protection principles, or

(b)

would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded.

.......

(5A) The duty to confirm or deny does not arise in relation to information which is (or if it were held by the public authority would be) exempt information by virtue of subsection (1).

(5B) The duty to confirm or deny does not arise in relation to other information if or to the extent that any of the following applies –

(a)

Giving a member of the public the confirmation or denial that would have to be given to comply with section 1(1)(a) –

(i)

would (apart from this Act) contravene any of the data protection principles, or

(ii)

would do so if the exemptions in section 24(1) of the Data Protection Act 2018 (manual unstructured data held by public authorities) were disregarded.

......

58 Determination of appeals

(1)

If on an appeal under section 57 the Tribunal considers—

(a)

that the notice against which the appeal is brought is not in accordance with the law, or

(b)

to the extent that the notice involved an exercise of discretion by the Commissioner, that he ought to have exercised his discretion differently,

the Tribunal shall allow the appeal or substitute such other notice as could have been served by the Commissioner; and in any other case the Tribunal shall dismiss the appeal.

(2)

On such an appeal, the Tribunal may review any finding of fact on which the notice in question was based”.

The Tribunal added

“12.

Section 3(2) of the Data Protection Act 2018 (“DPA”) defines “personal data” as “any information relating to an identified or identifiable living individual”. The “processing” of such information includes “disclosure by transmission, dissemination or otherwise making available” (s.3(4)(d) DPA), and so includes disclosure under FOIA.

13.

The data protection principles are those set out in Article 5(1) of the General Data Protection Regulation (“GDPR”), and section 34(1) DPA. Section 3(2) DPA defines “personal data” as “any information relating to an identified or identifiable living individual”. The first data protection principle under Article 5(1)(a) GDPR provides that, “Personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject”.

14.

In order to be lawful, processing must meet one of the conditions in Article 6(1) GDPR. The relevant condition in this case is condition 6(1)(f) GDPR – “processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data
subject which require protection of personal data, in particular where the data subject is a child.”

15.

This involves consideration of three questions (as set out by Lady Hale DP in South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55):

(i)

Is the data controller or third party or parties to whom the data are disclosed pursuing a legitimate interest or interests?

(ii)

Is the processing involved necessary for the purposes of those interests?

(iii)

Is the processing unwarranted in this case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject?

The wording of question (iii) is taken from the Data Protection Act 1998, which is now replaced by the DPA and GDPR. This should now reflect the words used in the GDPR – whether such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

16.

In Goldsmith International Business School v Information Commissioner and the Home Office [2014] UKUT 563 (AAC), Upper Tribunal Judge Wikeley provided guidance on the application of these tests. “Necessity” carries its ordinary English meaning, being more than desirable but less than indispensable or absolute necessity. The test is one of “reasonable necessity”, reflecting European jurisprudence on proportionality. This involves the consideration of alternative measures, so the measure must be the least restrictive means of achieving the legitimate aim in question.”

At the hearing Dr Myhill had very little to add to her skeleton argument and relied on the second limb of the test in Smith v. Cosworth Casting Processes Ltd [1997] 1 WLR 1538 to the effect that the Upper Tribunal has a discretion to give permission to appeal if there is a realistic prospect that the First-tier Tribunal’s decision was erroneous in law or if there is some other good reason to do so. That test, however, is relevant to the question of whether the Upper Tribunal should grant permission to appeal, not whether the First-tier Tribunal has erred materially in law. An appeal to the Upper Tribunal lies only on “any point of law arising from a decision” (section 11(1) of the Tribunals, Courts and Enforcement Act 2007), not on the facts of the case. I shall, however, proceed on the footing that Dr Myhill was maintaining all of her original grounds of appeal.

In her email of 27 October 2021 Dr Myhill adduced what essentially amounted to four grounds of appeal:

the ICO’s decision notice on 30 September 2019 agreed with her that the public interest was in her favour and demanded that under FOIA the GMC must release the evidence base for its decision making

the decision of the minority on the public interest issue was in her favour

new evidence had been released on 13 September 2021 which leant heavily in favour of disclosure

the ICO was allowing the GMC to get away with intellectual dishonesty and such dishonesty might well amount to misfeasance in public office.

Mr Kosmin submitted that the First-tier Tribunal had considered the issue raised by the appeal in a number of previous cases which had fallen to be determined under the Data Protection Act 1998, namely whether disclosure of the fact that a complaint had been made to a regulatory body about an identifiable individual (where that did not result in any disciplinary findings or proceedings) was compatible with the privacy rights of the individuals. The Tribunal had consistently upheld decisions by regulators to decline to confirm or deny whether information was held about a complaint/investigation in relation to named and identifiable individual.

Mr Kosmin relied on a number of First-tier Tribunal decisions, which were not binding on the Upper Tribunal, but on which he relied as reflecting the legally correct approach to be adopted to this appeal. They included Mr A v ICO and the Health Professions Council (EA/2011/0223), A v ICO and GMC (EA/2013/0014), Cubells v ICO and GMC (EA/2013/0038), Foster v IC and GMC (EA/2016/024), Kendall v ICO and GMC (EA/2019/0203) and Rushbrooke v ICO and GMC (EA/2020/0150V).

In A v ICO and GMC (EA/2013/0014) the Tribunal upheld the GMC’s reliance on s.40(5)(b)(i) FOIA in declining to confirm or deny whether it held information about a complaint made against a medical professional. The Tribunal held at [18] that information about a complaint made to the disciplinary panel of a profession constituted the personal data of the individual against whom the complaint is made. It expressed no doubt at [21] that a medical practitioner was entitled to privacy over a complaint made against him that did not have sufficient merit to be put before the disciplinary panel. As in the instant appeal, the fact that the requester was aware that the complaint had been pursued by the GMC in a particular manner and had received information relating to a complaint in the context of subject access request under the DPA did not alter that conclusion at [23].

In Cubells v ICO and GMC (EA/2013/0038), to which I refer again later in this decision, the Tribunal specifically drew attention to (i) the need to assess the impact of disclosure to the world at large and (ii) the fact that confirming whether the information was held would be unfair in light of the fact that complaint has been dismissed without formal investigation and in light of the GMC’s known publication and disclosure policy. It also confirmed at [23] that it should not consider the merits of the GMC’s fitness to practise investigations:

“… it is not the function of the Tribunal to form, still less to express opinions on medical issues. We are therefore not assisted by arguments as to the alleged failures or misconduct of the doctors concerned, whether directly or as expert adviser.”

In Foster v IC and GMC (EA/2016/024) the Tribunal considered whether the GMC had correctly relied on s.40(5)(b)(i) FOIA to decline to confirm or deny whether it held the names of persons who had been involved in the investigation of a complaint against a named doctor. It held at [19] that:

“… there was considerable merit in the GMC’s approach in this case – namely to only confirm or deny that a complaint had been made against a particular doctor if that complaint had been referred to a MPT or if the complaint had resulted in warnings or restrictions being placed on the doctor’s registration – that is if the complaint was deemed to have some merit even if it had not been upheld by a MPT. The Tribunal considered that this struck an appropriate balance between complaints with some merit – where their existence should be disclosed – and complaints which were likely to be without merit or indeed even malicious and where disclosure of their existence would cause unjustified distress to the doctor in question which was not warranted. The Tribunal concluded that to confirm or deny the existence of the latter type of complaint would be unfair to the doctor in question and thus in breach of the data protection principles”.

In Kendall v ICO and GMC (EA/2019/0203), the Tribunal considered the position under the GDPR, and whether the GMC was entitled neither to confirm nor deny whether information was held in response to a request for information in relation to an investigation into a named doctor. It held at [19] that the requested information clearly contained personal data as it asked whether a named doctor had been subject of GMC investigations. Whilst the Tribunal found that the appellant and the wider public had legitimate interests in the disclosure of the data (namely a wish to pursue a civil or criminal action against the doctor and an interest in knowing whether a doctor has been the subject of a serious complaint respectively), a confirmation or denial as to whether a complaint had been made against a doctor was not reasonably necessary for pursuing either interest:

“24.

The appellant’s personal interest in the information is based on potential legal claims. We find that confirmation or denial by the GMC as to whether there were complaints under investigation against the named doctor under FOIA is not reasonably necessary for pursuing this interest, and there are other means of achieving this which are less intrusive.

25.

The existence of complaints against the doctor at the time of the appellant’s relative’s treatment might be relevant to legal claims, in that it would show that others had complained about the doctor’s practice. Similarly, the existence of complaints at the time of the Request would indicate concerns from others about the doctor. However, the fact of a complaint investigation by the GMC does not indicate that the complaint has any merit. This information is not necessary for the appellant to decide whether to bring a claim, because confirmation as to whether or not other complaints have been investigated is not evidence that the doctor was negligent in the treatment of the appellant’s relative. If a claim is made, disclosure of information about complaints and GMC investigations may be required if it is relevant to the case – including more detail than a simple confirmation or denial. This would help the appellant’s interests in bringing the claim, but would be done under the usual duties of disclosure with restrictions on how the information may be used. This is a less intrusive and more effective way of furthering the appellant’s interests in the information than disclosure to the world at large under FOIA.

26.

The public interest is based on knowing whether a treating doctor is the subject of serious complaints and so fit to be treating them. We find that confirmation or denial by the GMC as to whether there were complaints under investigation against the named doctor under FOIA is not reasonably necessary for pursuing this interest. The existence of a complaint which is under investigation by the GMC provides no information about the doctor’s actual fitness to practise. The GMC receives many complaints, and only a minority proceed to a finding that the doctor is not fit to practise. The GMC publishes decisions by the relevant Tribunals and Investigation Committees, and undertakings agreed with individual doctors. Tribunal hearings are also public. These steps provide the public with information about enforcement actions and sanctions that have actually taken place. This furthers the public interest in knowing whether the GMC has found a problem with a doctor’s fitness to practise, or has sufficient concerns for the matter to progress to a public Tribunal hearing. This is a more accurate way of providing such information to the public than disclosure of the existence of investigations into complaints which have not resulted in action by the GMC.

27.

The appellant makes the point that he considers the GMC investigative process is unsatisfactory because the majority of complaints are never formally investigated, and the chances of obtaining information about a doctor based on the GMC’s publication process is extremely remote. We do not agree that this makes it reasonably necessary for personal data about a named doctor to be disclosed under FOIA. If there has been poor performance in an investigation by the GMC, this can be challenged by way of a review under the relevant rule, or through judicial review. As already noted, the existence of a complaint against a doctor does not indicate that the complaint has any merit or that there is any impairment of the doctor’s fitness to practise under the GMC regime.

28.

The appellant submits in his response to the GMC that this approach is inherently unfair to the public. He says that confirmation would tell the public that a doctor who was the subject of a current complaint had been permitted to continue to practise by the hospital, and this is relevant to both the hospital’s and the doctor’s negligence. We accept that there would be a public interest in knowing that a doctor who is not fit to practise has been allowed to continue working without appropriate safeguards. But, confirmation or denial of the existence of a complaint investigation does not provide this information. As already noted, the existence of a complaint does not mean there is any actual problem with a doctor’s practise, and so publication of details about complaints would be misleading. The GMC is concerned only with whether there is an ongoing problem with a doctor’s fitness to practise. If so, details of enforcement actions and sanctions are published and so made available to the public.

29.

The appellant also submits that publication would enhance the performance of doctors overall, if they knew more information would be available. We do not agree with this. Publication of information about complaints which have not been substantiated would be unfair to the doctor, and in our view, would be more likely to inhibit a doctor’s practice than enhance performance.

30.

The appellant also complains that the GMC decides itself what to disclose, and further information could be disclosed while keeping confidentiality over the detail of a specific complaint – e.g. numbers of complaints and findings. This challenge to the GMC’s practice is outside our remit. We are limited to considering whether the GMC should have answered the appellant’s specific Request.”

In Rushbrooke v ICO and GMC (EA/2020/0150V), the Tribunal considered whether the GMC had correctly relied on s.40(5)(b)(i) FOIA to decline to confirm or deny whether it held the professional qualifications of an Assistant Registrar who had decided not to commence an investigation in respect of the fitness to practise of a doctor. As in this appeal, the appellant contended that she was not asking for personal data relating to the doctor in question. Relying on Independent Parliamentary Standards Authority v Information Commissioner & Leapman [2014] EWCA Civ 388; [2015] 1 WLR 2879 and noting that disclosure would be to the world at large, the Tribunal held at [38]:

“… it is my view that the Commissioner reached the correct view that confirming or denying whether the information is held would amount to disclosing personal information about the Doctor. Public confirmation as to whether the information is held would equate to a public disclosure that the GMC had received and considered an allegation against the Doctor identified (as I have found) in the Appellant’s request, and that would entail the processing of the personal data of the Doctor. To be clear, it is not the personal data of the Assistant Registrar that is in issue, but the personal data of the Doctor.”

The appellant also contended that the public interest favoured disclosure in any event, but the Tribunal rejected that submission at [42]:

“I understand that conclusion will be upsetting to the Appellant, but where there are competing interests, as there are in this case, a judgement has to be made as to which will prevail. The choice in this case is that the weighty expectation of privacy of the Doctor outweighs the understandable concern of the Appellant that the GMC employs suitably qualified personnel to make decisions on complaints.”

Although none of those decisions is binding on the Upper Tribunal, I am satisfied that they were all correctly decided and Dr Myhill was not in a position to suggest otherwise.

The first ground of appeal is misconceived and can be dealt with shortly.

The September 2019 decision notice did not impose an obligation on the GMC to disclose the Information which was the subject of Dr Myhill’s request. What it did was to oblige the GMC to provide a FOIA-compliant response to her request for information, which is what the GMC proceeded to do. In any event, the September 2019 decision notice was not the subject of any appeal.

The Tribunal was therefore correct to hold as it did in paragraph 23 of the decision:

“The September Decision Notice required the GMC to provide a response to the appellant under FOIA. This was because the GMC had failed to deal with the appellant’s correspondence as a FOIA request. Importantly, it did not require the GMC to actually provide the requested information. The GMC did then provide a response under FOIA. This response was a refusal to confirm or deny if the information was held. They relied on one of the exemptions under FOIA which relates to data protection. Therefore, the GMC did do what was required by the September Decision Notice – they provided a response to the appellant under FOIA.”

Although Dr Myhill did not put the second ground of appeal at the forefront of her grounds, that was the real nub on the appeal and I asked Mr Kosmin to address me on that basis.

Mr Kosmin’s basic point was that, although Dr Myhill obviously supported the dissenting opinion, the fact that there was a minority opinion did not demonstrate that the appeal had merit in circumstances in which she had failed to establish any error of law on the part of the majority.

That is sufficient to determine the second ground of the appeal. Dr Myhill was unable to explain why the decision of the majority was wrong in law, although she did not agree with them. In the absence of being able to demonstrate an error of law, the fact that the Tribunal was split in it analysis does not demonstrate that its decision, albeit by a majority on one point, was wrong as a matter of law.

That is sufficient to dispose of that ground of appeal, but I invited Mr Kosmin to make submissions on the basis that Mr Clarke’s dissent was wrong and that the majority was correct in its conclusion.

Mr Kosmin submitted that the essence of what Mr Clarke had decided was that reference to one of the doctors in a parliamentary debate was sufficient to swing the balance of the public interest:

“44.

Evidence given to us showed that the conduct and validity, and therefore the findings, of this trial became the subject of extensive dispute in professional journals and gave rise to two debates in Parliament, in at least one of which one of the doctors was named. Dr Myhill gave evidence, which was not contested by the GMC, that as a result of these debates, the NICE
guidelines were altered.”

Mr Kosmin pointed out that Mr Clarke accepted at [45] that the Tribunal had neither the jurisdiction nor the expertise to reach any conclusions on the clinical issues. He also submitted that Mr Clarke accepted at [46] that (i) confirmation or denial that the information was held would reveal personal information about the doctors involved and (ii) the stance of the GMC to neither confirm nor deny whether information was held was entirely correct in the more usual type of case where a complaint, if it existed, against a doctor about individual treatment was not taken to the next stage (in other words, accepting that the bede-roll of earlier First-tier Tribunal decisions, to which I have referred above, was correct).

Mr Clarke’s conclusion at [46] was that

Mr Kosmin submitted that that was wrong because reference to one of the doctors in a debate should not be enough to swing the balance of the public interest. Prior publication elsewhere should not defeat the expectation of privacy and was plainly contrary to the statutory scheme under which the GMC operated. Moreover, Mr Clarke’s reliance on the alteration of the NICE guidelines had not occurred by the date of the hearing, but only subsequent to it.

In that context Mr Kosmin referred to the decision of Upper Tribunal Kate Markus QC in Morton v (1) ICO (2) Wigan MBC [2018] UKUT 295 (AAC).

“39.

I am considering whether the information was exempt at the time of refusal of the request. At that time, there was a certain amount of relevant information in the public domain. The terms of reference of the Review had been disclosed at the time of the request. These explained the context in which the Review was commissioned. The Audit Commission report is a public document. The Audit Commission report which is in the bundle referred to previous Audit Commission criticisms of the Council’s whistleblowing arrangements, noted that changes had been made by the Council and recommended review of the adequacy of the arrangements and corrective action to be taken. I was not shown the previous findings by the Commission regarding whistleblowing, but it is likely these would have shed further light on how the Council dealt with whistleblowing. The Penn Report addressed the conduct of the procurement exercise in considerable detail, the actions of the whistleblowers and the allegations of detrimental treatment of the whistleblowers.

…

48.

Mr Morton knew the identities of the whistleblowers referred to in the Report. At the hearing he said that he knew the full names of two of them and the first names of two. He had been in touch with them regarding previous matters which were of mutual interest to them. He worked in the Council until 2008 and was employed by the Council until 2012. It is likely that some of the whistleblowers would have been employed at the same time as he was. I have no doubt that Mr Morton would be able to identify the whistleblowers from the information in the Report, even if their names and job titles were redacted.

…

50.

The same is true of the Council officers referred to in the Report. Even if their names and job titles were redacted, anyone with a working knowledge of the Council’s staff and operations would be able to work out who is referred to. Some present or former employees would know about the events surrounding the procurement process and so would be particularly well placed to identify them.

…

52.

This is not a case in which those “in the know” would only discover that which is already known to them. Any person who knew some of the story would be likely to be provided with information as to the accounts or views of others of which they were not previously aware. Moreover, they would obtain information as to the assessment by Nicholas Warren which they would not previously have been aware of.

…

57.

There was no serious suggestion that the data in the Report did not relate to individuals. It touches directly on their privacy, in relation to their personal and professional conduct, their professionalism and probity, and affects or is capable of affecting their reputations.

…

61.

As far as the Council officers are concerned, the publication of the report would once again place in the public arena the allegations as to their conduct which had already been subject to extensive investigation. They had been suspended and then exonerated. In fairness, they should have been able to treat those matters as closed and get on with their professional and personal lives without the shadow of interest in those matters being aroused again. I agree with the Commissioner that, given the previous media interest in these matters, it is likely that publication would cause stress and anxiety to the individuals, and impact on their present work with possible longer term repercussions for their careers. In reaching this conclusion (as well as in my consideration of the whistleblowers’ expectations, below), I have disregarded the recent contact from the whistleblowers because, as I have explained earlier in these Reasons, their position was tentative and, in any event, shed little if any light on what their position was at the time of request or the refusal of the request.

…

68.

Mr Morton argued that, as the whistleblowers had already been identified as such in previously published reports, they could not have thought that publication of the Warren Report would make any difference to them and it would not have been reasonable for them to have expected that the Warren Report would not be published. I do not agree. The Penn Report did not refer to the whistleblowers by name and, although the inadvertent identification of one of the whistleblowers had occurred by then, the remainder were publicly anonymous at that time and, it appears, remained anonymous. The Audit Commission report did not refer to the whistleblowers by name and it does not appear that they were identified consequent on the publication of that report. The reports relating to the treatment of Mr Morton and the Thynne Reports were concerned with separate matters. Mr Morton has not suggested that he did not consent to publication of the reports concerning him. There has been no suggestion that assurances of confidentiality were given to those who were identified in the other reports, and the clear assurance that the Warren Report would be confidential marked a different approach to that Report as compared to the earlier reports.”

Mr Kosmin submitted that what Judge Markus QC had held in paragraph 68 of her decision in Morton made it clear that Mr Clarke’s reliance on the reference to one of the doctors in a debate as altering the balance of the public interest in favour of disclosure was wrong.

I have dismissed this ground of appeal on the narrow basis set out in paragraph 32 above. Nevertheless, had it been necessary to do so, I would have agreed with Mr Kosmin’s analysis. Reference to only one of the doctors in a debate should not be enough to swing the balance of the public interest in favour of disclosure on the facts of this case and prior publication elsewhere should not defeat the doctors’ expectation of privacy

The new evidence on which Dr Myhill relied, in the form of update NICE guidance on the management of patients living with myalgic encephalomyelitis/chronic fatigue syndrome (ME/CFS) was released in draft form on 13 September 2021 (and in final form on 29 October 2021). That evidence was obviously not in existence at the time at which the GMC dealt with the request for information on 24 October 2019 (nor indeed did it exist at the time of the hearing before the Tribunal or even at the date of its decision. It is difficult to see how the Tribunal could have erred in law in not taking into account a document which did not exist at the time of its decision).

The short answer is that that later evidence cannot be relied on to seek to impugn a decision made at the earlier date in October 2019.

In Montague v ICO and Department for International Trade [2022] UKUT 104 (AAC), the Upper Tribunal concluded at [3]-[5] that

“3.

The second issue is the question of whether information that is disclosed after a public authority’s decision on a request (for example, during the Commissioner’s investigation, in the course of First-tier Tribunal proceedings or as a result of a Tribunal’s decision) should be treated as in the public domain for the purpose of weighing the public interest in disclosure of any remaining requested information (“the Public Interest Timing Issue”). Included within this issue is whether a public authority’s decision on a request includes any later decision on review by it of its initial decision refusing the request.

…

5.

As to the Public Interest Timing Issue, we conclude it is to be judged at the time the public authority makes its decision on the request which has been made to it and that decision making time does not include any later decision made by the public authority reviewing a refusal decision it has made on the request.”

Mr Kosmin also relied on the following paragraphs of the decision in Montague which explain the reasons for the Upper Tribunal’s conclusion:

“The Public Interest Timing Issue

47.

The time at which the public interest considerations fall legitimately to be considered on a FOIA request is in play in this appeal. This is because in its consideration of “a number of factors which go substantially to reduce the public interest in disclosure of the withheld material”, the FTT relied (in paragraph 110 of its decision) on information which had come into the public domain well after the DIT had made its decision to refuse Mr Montague’s request.

…

54.

On the public interest timing issue, it has been settled practice, if not law, since the Supreme Court’s decision in R(Evans) v HM Attorney General [2015] UKSC 21, [2015] 1 AC 1787, that the balancing of the public interest factors in favour and against disclosure falls to be judged “as at the date of the original refusal” (para. [73]). The full context on this point is in paragraphs [72] and [73] of Evans:

“72……It is common ground, in the light of the language of sections 50(1), 50(4) and 58(1), which all focus on the correctness of the original refusal by the public authority, that the Commissioner, and, on any appeal, any tribunal or court, have to assess the correctness of the public authority’s refusal to disclose as at the date of that refusal…….

73.

However, although the question whether to uphold or overturn (under section 50 or sections 57 and 58) a refusal by a public authority must be determined as at the date of the original refusal, facts and matters and even grounds of exemption may, subject to the control of the Commissioner or the tribunal, be admissible even though they were not in the mind of the individual responsible for the refusal or communicated at the time of the refusal to disclose (i) if they existed at the date of the refusal, or (ii) if they did not exist at that date, but only in so far as they throw light on the grounds now given for refusal…..”

…

60.

We do not accept the argument that the public authority’s decision refusing the request includes the upholding of that decision following the internal review of that decision by the authority. It is an argument with no clear statutory basis, arguably stands contrary to the wording used by the Supreme Court in Evans, and lacks material support from APPGER because the point was not in issue in that case. We also do not consider that Maurizi decides this point conclusively in favour of the refusal decision including the upholding of that decision on review.

61.

Although the language in Evans of original refusal may be explained simply on the basis of it identifying the public authority’s refusal as opposed to any later stage of decision making on the same request, the structure of sections 50 and 58 of FOIA do not lend themselves to either the Information Commissioner or the First-tier Tribunal making decisions to refuse the request. This is a point to which Lord Neuberger refers and appears to have considered was well made in paragraph [72] of Evans, albeit it was based on a commonality of argument before the Supreme Court in that case. Seen from this perspective, the views of the Upper Tribunal in Evans, as recorded in paragraph [39] of the Supreme Court’s judgment in Evans (see paragraph 54 above), may provide a point of contrast with the language of the ‘original refusal’ decision.

62.

The Information Commissioner’s function under section 50(1) of FOIA is to decide “whether…a request for information made by the complainant to a public authority has been dealt with in accordance with the requirements of Part I [of FOIA]”. We will return shortly to address what the ‘requirements’ of Part I include. The short point, however, is that they involve no requirement for a public authority to review its decision refusing the request. Moreover, if the Information Commissioner finds that a public authority has failed to communicate information under section 1(1) when it ought to have done so, has failed to communicate the information by an appropriate means (per section 11 of FOIA), or has not given the requestor an appropriate notice of its refusal decision (per section 17 of FOIA), by section 50(4) he is required to serve a decision notice on the public authority specifying the steps the public authority must take to remedy the failure. As a matter of statutory language, the Information Commissioner is not himself charged with redeciding the request. Even the enforcement notice provisions in section 52 of FOIA are

about the Information Commissioner requiring the public authority to remedy a mistake it has made under Part I. The Information Commissioner is still provided with no statutory basis for deciding the request. He is to decide whether the public authority dealt properly with the request. Likewise, the FTT’s role under section 58 is focused on the correctness of the Information Commissioner’s notice under appeal. Again as a matter of the statutory language, the FTT’s function is not to redecide the request.

63.

When read in context the language of ‘original decision’ in Evans therefore supports a conclusion that the competing public interests have to be judged at the date of the public authority’s decision on the request under Part I of FOIA and prior to any internal review of that initial decision. And Evans certainly lends no support to the DIT’s argument about the appropriate date here being the ‘final’ decision of the public authority whenever so made.”

Moreover, in the instant appeal the Upper Tribunal was not considering the public interest test as it arose under ss.2(1)(b) and 2(2)(b) of FOIA, but the balancing test which fell to be undertaken pursuant to Article 6(1)(f) of the GDPR: see ICO v Halpin [2019] UKUT 29 (AAC) at [29]:

“At paragraph 52 of its decision the FTT treated the approach to disclosure under FOIA and that under the DPA as being the same. This is incorrect. The observations of Lord Rodger of Earlsferry in Common Services Agency v Scottish Information Commissioner [2008] 1 WLR 1550 at [68], which the FTT relied upon, do not support any such equivalence. In the same case at [7] Lord Hope said of the DPA and the EU Directive which it implemented, “the guiding principle is the protection of …[the] right to privacy with respect to the processing of personal data”. FOIA creates a general right to information subject to the exemptions in Information Commissioner v Halpin (GIA) [2019] UKUT 29 (AAC) section 2. Section 40(2) creates an absolute exemption for information which may not be disclosed under the DPA, and under the DPA personal data is protected unless disclosure is justified. Upper Tribunal Judge Wikeley explained the position as follows in Cox v Information Commissioner and Home Office [2018] UKUT 119 (AAC) at [42]:

“…the balancing process in the application of the Goldsmith questions “is different from the balance that has to be applied under, for example, section 2(1)(b) of FOIA” (see GR-N v Information Commissioner and Nursing and Midwifery Council [2015] UKUT 449 (AAC) at paragraph 19). Furthermore FOIA stipulates that the section 40(2) exemption applies if disclosure would contravene the data protection principles enshrined in the DPA, so it is the DPA regime which must be applied. There is no obvious reason why the general transparency values underpinning FOIA should automatically create a legitimate interest in disclosure under the DPA.”

Under Article 6(1)(f) of the GDPR, the legitimate interests pursued by the appellant are to be balanced against the interests or fundamental rights and freedoms of the data subject. The relevant balancing test falls to be undertaken as on the date of the public authority’s refusal of an information request. That was on 24 October 2019,

Events post-dating the date at which the relevant balancing exercise falls to be conducted are irrelevant. If it was said (as appeared to be the case in the grounds of appeal) that circumstances had changed materially following the GMC’s refusal of the request, the proper course was not to introduce that new evidence in the course of an existing appeal: see APPGER v ICO & FCO [2015] UKUT 377(AAC) at [56]:

“In other cases, and this is an example, there are clearly disadvantages in the Commissioner and then the FTT and then further appellate tribunals and courts being faced with a moving target on public interest issues. This is particularly so when one remembers that the trigger to the FOIA jurisdiction is a request to a public authority holding information. Indeed it seems to us that Parliament would not have intended that the public authority would effectively be removed as the decision maker because the passage of time and changes in circumstances even if the last date for appellate tribunals

and courts was the hearing before the FTT. Rather it seems to us that Parliament would have intended that the requester should make a further request if he wished to rely on changes over time to the public interest factors.”

The essence of Dy Myhill’s submission was that

“3.3

The FTT may or may not have erred in law with their decision of 7 April 2021. I submit that the relevant considerations were changed by the publication of the new NICE guideline and that the law should be re-examined in the light of that development”.

If the Tribunal did not err in law, that is an end of the appeal. If the submission is that it did err in law on the basis that the relevant considerations in relation to the public interest were changed by material which did not exist at the date of the GMC’s original decision on 24 October 2019, the submission is misconceived and contrary to authority. The appeal must therefore fail. The case should not be remitted back to the Tribunal for rehearing.

If there has been a change of circumstances, it is open to Dr Myhill to make a fresh request, see APPGER at [56]. What the outcome of any such request would be is not a matter which I have to decide.

For the sake of completeness, I should add that I also accept Mr Kosmin’s point that the Upper Tribunal should not seek to be drawn into adjudicating on matters of medical expertise. Dr Myhill invited the Upper Tribunal to consider the substance of the “new NICE guidance” to make a finding on matters of medical expertise, including:

“If NICE can find no evidence that Graded Exercise Therapy improves CFS/MR then surely the GMC cannot either”

and the alleged harm caused by graded exercise therapy (as to which see paragraph 2.1 to 2.4 of her skeleton argument of 19 May 2022). On the contrary, as stated in Cubells v ICO and GMC, the Upper Tribunal should not be drawn in to forming, still less expressing, opinions on matters of medical expertise. Indeed, Dr Myhill accepted that proposition in her brief reply to Mr Kosmin’s submissions.

The fourth ground of appeal is as misconceived as the first and can be dealt with equal brevity.

There is no evidence whatsoever of any intellectual dishonesty or misfeasance on the part of either the ICO or the GMC and I emphatically reject the ground of appeal.

The Tribunal made its findings of fact and gave adequate reasons for reaching the conclusion which it did. I can see no error of law in the way in which it went about its task or in the decision which it reached or in the adequacy of the reasons which the majority gave for that decision. The function of the First-tier Tribunal is to assess whether the Information Commissioner’s decision notice “against which the appeal is brought is not in accordance with the law” (s.58 of FOIA). That the First-tier Tribunal has done. I can detect no error of law in its decision.

For these reasons I am satisfied that the majority of the Tribunal was correct in the conclusion which they reached in paragraphs of their decision and that the appeal should be dismissed.

For the avoidance of doubt the rule 14 Order which I made on 31 May 2022 continues in force.