Decision 112/2009 Mr C and Highland Health Board
General Medical Council decision about a GP
Reference No: 200900441
Decision Date: 28 September 2009
Summary
Mr C asked NHS Highland (the Board) to provide information relating to a decision by a General Medical Council (GMC) Interim Orders Panel in respect of his General Practitioner (GP), and information about any action the Board may have taken arising from the GMC decision.The Board advised that the information was considered to be confidential and that investigations were ongoing. Following a review, Mr C was advised that the information was personal data which was protected by the Data Protection Act 1998 (the DPA).Mr C remained dissatisfied and applied to the Commissioner for a decision.
Following an investigation, the Commissioner found that the Board was correct to withhold all of the information covered by Mr C's request under section 38(1)(b) of FOISA, as to disclose the information would contravene the first data protection principle in the DPA.However, the Commissioner found that the Board had failed to give notice that it did not hold some of the information Mr C had requested, as required by section 17(1) of FOISA, and had failed to respond to Mr C's request for review within the timescale specified in section 21(1) of FOISA.
Relevant statutory provisions and other sources
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1) and (2)(e)(ii) (Effect of exemptions); 17(1) (Information not held); 21(1) (Review by Scottish public authority) and 38(1)(b), (2)(a)(i) and (b) (Personal information)
Data Protection Act 1998 (the DPA) section 1(1) (Basic interpretative provisions) (definition of personal data); 2 (Sensitive personal data) and Schedules 1 (The data protection principles) (the first data protection principle); 2 (Conditions relevant for purposes of the first principle: processing of any personal data: condition 6) and 3 (Conditions relevant for purposes of the first principle: processing of sensitive personal data) (paragraphs 1 and 5)
The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision. The Appendix forms part of this decision.
Background
1.On 21 September 2008, Mr C wrote to the Board about a notice published by the GMC, which imposed conditions upon his GP's registration with the GMC.Mr C stated:
I am (?) seeking any information the Health Board hold relating to the decision by a GMC Interim Orders Panel in respect of my GP, or any other information held by the Board concerning any action the Board may have taken arising from the GMC decision.
Mr C explained that the notice published by the GMC gave him cause for concern and he wanted to make an informed decision about his future healthcare provision.He added:
I emphasise I am not looking for any detailed personal information about my GP or any person who may have complained, or detail about the matter.I only wish to know the nature of the complaint, in order to assist my decision about whether to remain with my GP.
2.The Board responded on 13 October 2008. It did not frame its response in terms of FOISA, but advised Mr C that there was a difficulty about releasing confidential information regarding complaints against a GP, and explained that various investigations were ongoing.The Board advised that it could not comment on the specific situation involving this particular GP, but noted that the GP remained on the 'performers list' and as such was deemed fit to practice.The Board advised that where there were significant concerns about a GP's clinical competence then they would often be suspended and locums employed to cover the service while investigations were completed.
3.On 13 October 2008, Mr C wrote to the Board requesting a review of its decision.He believed his need to have information which would enable him to make decisions about his healthcare had not been correctly balanced against the issues of confidentiality to which the Board had referred.He argued that once the GMC had published a notice warning that there were circumstances surrounding the competency of his GP, the balance moved towards making information available in the public interest.Finally, Mr C asked how the Board was to be scrutinised in terms of its duty to provide the best care available to patients, if such information was not provided.
4.The Board acknowledged Mr C's request for review on 14 October 2008.On 22 October 2008 Mr C was advised that his request for review would be dealt with under the NHS Complaints Procedure.He queried this in an email sent on 22 October 2008.On 23 October 2008 Mr C was asked to confirm that he wished to proceed with the Board's review via the Complaints Procedure.On 25 October 2008 Mr C reiterated that he was requesting a review of the Board's refusal to provide information, and that it was irrelevant to him which internal procedure the Board used to undertake the review.The Board responded on 27 October 2008, providing Mr C with a leaflet about the NHS Complaints Procedure, and advising that he would receive a response to his review request within 20 working days.
5.On 25 November 2008, the Board wrote to advise Mr C that it would not be possible to issue a response within the timescale previously indicated.On 8 December 2008, Mr C sent an email asking the Board to explain the delay in responding and to provide the information he had requested.On 15 December 2008 he sent another email, to complain that he had received no response.
6.The Board replied by email on the same day (15 December 2008), enclosing a letter dated 11 December 2008 which provided its review response.The Board upheld the decision to withhold the information requested, explaining that it owed a duty of confidentiality to the GP and any one who complained about him.It regarded any complaints against an individual as personal data protected by the DPA.The Board also advised that the GP had resigned and was no longer with the practice.
7.On 5 March 2009 Mr C wrote to the Commissioner stating that he was dissatisfied with the outcome of the Board's review and applying for a decision in terms of section 47(1) of FOISA.Mr C also expressed dissatisfaction with the length of time the Board had taken to respond to his request and request for review.
8.The application was validated by establishing that Mr C had made a request for information to a Scottish public authority and had applied to the Commissioner for a decision only after asking the authority to review its response to that request.
Investigation
9.On 23 March 2009, the Board was notified in writing that an application had been received from Mr C and was asked to provide the Commissioner with any information withheld from Mr C. This information was provided on 16 April 2009 and the case was then allocated to an investigating officer.
10.The investigating officer contacted the Board on 27 April 2009, giving it an opportunity to provide any comments it wished to make on Mr C's application (as required by section 49(3)(a) of FOISA). The Board was also asked to confirm that it was relying on the exemption in section 38(1)(b) of FOISA, and to confirm which of the data protection principles would (in its view) be contravened by disclosure of the information in question.
11.This letter also noted that a search of information on the GMC's website had confirmed that the registration of the GP to whom Mr C's request related had been suspended in December 2008.The Board was asked whether the fact of this suspension by the GMC would affect the Board's response to Mr C's request.
12.The Board replied on 22 May 2009.It confirmed that it was relying upon the exemption in section 38(1)(b) of FOISA (read in conjunction with section 38(2)(a)(i) and/or (b)).The Board considered that the first data protection principle would be contravened by disclosure of the information.The Board advised that it did not feel that its response to Mr C would be affected by the GMC decision to suspend the GP, although this situation might change if the GMC held a formal hearing of the complaints against the GP.
13.During the investigation, Mr C was provided with an opportunity to provide additional comments on the case.In particular, he was invited to explain his reasons for seeking the information in order help assess his legitimate interests in accessing the information against the GP's interest in keeping the information confidential.In response, Mr C provided further background information to explain his reasons for requesting the information.Although intervening events meant that the GP concerned was no longer working in his practice, he felt that he should have received the information at the time he had requested it to enable him to make informed decisions about his medical care.
Commissioner's analysis and findings
14.In coming to a decision on this matter, the Commissioner has considered all of the withheld information and the submissions made to him by both Mr C and the Board and is satisfied that no matter of relevance has been overlooked.
Scope of the request
15.Mr C's request referred to "the decision by a GMC Interim Orders Panel in respect of my GP".The GP in question has been the subject of three Interim Orders Panel decisions to date, but only one of these pre-dates Mr C's request: this is the order made on 25 April 2008, which imposed conditions on the GP's registration for a period of 18 months.
16.For the purposes of this Decision Notice, the Commissioner has considered only such information as relates to the Interim Order Panel decision of 25 April 2008.He has excluded from consideration any recorded information which post-dates Mr C's request of 21 September 2008.
Information in the public domain
17.The GMC website offers guidance and information about the process by which the GMC investigates complaints and concerns about doctors' fitness to practice, and the circumstances in which it can take action.The website lists a number of reasons why a doctor's fitness to practice might be impaired:
misconduct;
deficient performance;
a criminal conviction or caution in the British Isles (or elsewhere for an offence which would be a criminal offence if committed in England or Wales);
physical or mental ill-health;
a determination (decision) by a regulatory body either in the British Isles or overseas.
18.The GMC publishes all Interim Orders Panel decisions on its website.The published orders provide the doctor's name with their field and place of practice, and list any conditions, restrictions or undertakings affecting the GP's registration.The orders do not detail reasons for the decision or indicate the matters which have been investigated, and are subject to review within 6 months.
19.If the GMC refers the matter to a Fitness to Practice panel, the hearing is held in public unless it is considering evidence about a doctor's health.Until that point, information about the investigation is generally not placed into the public domain.
Information not held ? section 17 of FOISA
20.Section 17(1) of FOISA requires that, where an authority receives a request for information that it does not hold, it must give an applicant notice in writing that the information is not held.
21.Part of Mr C's request was for information concerning any action the Board may have taken arising from the GMC decision (understood to be the Interim Orders Panel order of 25 April 2008).No information relating to this request was found among the documents withheld from Mr C, and the Board was asked about this omission during the investigation.After making further enquiries, the Board confirmed that at the time of Mr C's request it did not hold any recorded information about actions it had taken in relation to the GMC decision.
22.The information provided to the Commissioner shows that the GMC was actively engaged in assessing the doctor's fitness to practice during the summer months of 2008.The GMC reviewed the order made against the GP on 10 October 2008 and submitted its assessment report to the Board on 10 November 2008.The fact that the GMC had not yet completed its assessment and report at the time of Mr C's request may go some way towards explaining why the Board does not hold any information about actions it took following the GMC decision of 25 April 2008.In any event, the Commissioner accepts that the Board has now carried out sufficient searches and enquiries to establish that no recorded information relating to this part of Mr C's request is held by the Board.
23.The Commissioner finds that in failing to notify Mr C that this information was not held, the Board failed to comply with section 17(1) of FOISA.
Information withheld ? scope of investigation
24.The Board provided the Commissioner with 73 documents which were described as "withheld from Mr C".On examination, the Commissioner found that a number of the documents comprised information which did not appear to be covered by the terms of Mr C's request, although they did concern related matters.The Commissioner queried this with the Board, who confirmed that it had taken "the very widest view" and had provided the complete file rather than inadvertently omit something which might be relevant.
25.The Commissioner does not consider any of the contents of the following documents to be covered by the request, and has not considered them in his decision:documents 6, 7, 20, 21, 22, 32, 52, 54, 60, and 61.
Personal data ? section 38(1)(b) of FOISA
26.The first part of Mr C's request was for "any information the Health Board hold relating to the decision by a GMC Interim Orders Panel in respect of my GP ". The Board identified a number of documents relevant to this part of the request, but withheld the information under section 38(1)(b) of FOISA.
27.Section 38(1)(b), read in conjunction with section 38(2)(a)(i) or (b) exempts information from disclosure if it is "personal data" as defined by section 1(1) of the DPA and its disclosure would contravene one or more of the data protection principles set out in Schedule 1 to the DPA. This is an absolute exemption which is not subject to the public interest test laid down by section 2(1)(b) of FOISA.
28.In order for a public authority to rely on this exemption, it must show firstly that the information which has been requested is personal data for the purposes of the DPA and, secondly, that disclosure of the information would contravene at least one of the data protection principles laid down in the DPA.
29.The Board took the view that the information constituted personal data which, if disclosed, would contravene the first data protection principle in the DPA.
30.Personal data is defined in section 1(1) of the DPA as data which relate to a living individual who can be identified a) from those data, or b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller (the full definition is set out in the Appendix).
31.The first data protection principle states that personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 to the DPA is met, and, in the case of sensitive personal data, at least one of the conditions in Schedule 3 to the DPA is also met.
32.The Commissioner is satisfied that the information withheld in this case constitutes the personal data of the GP in question for the purposes of section 1(1) of the DPA, in that it relates in its entirety to the GP (in that he and matters concerning his practice are the focus of all correspondence and other documents withheld), and the GP can be identified from the information.
Sensitive personal data
33.Although the Board has not identified any of the information as "sensitive personal data", the Commissioner takes the view that some of the information withheld should be considered as such (the full definition is set out in the Appendix).
34.Given the additional restrictions surrounding the disclosure of sensitive personal data, the Commissioner first considered whether there are any conditions in Schedule 3 which would permit the sensitive personal data to be disclosed.If none of the conditions in Schedule 3 can be met, the information cannot lawfully be disclosed.
35.There are 10 conditions listed in Schedule 3 to the DPA. In guidance issued by the Commissioner on the interpretation of the exemptions in section 38[1], it is noted that because of the restrictive nature of the conditions in Schedule 3, generally only the first and fifth conditions might be relevant when considering a request for sensitive personal data under FOISA.
36.Condition 1 allows processing where the data subject (in this case, the GP) has given explicit (and fully informed) consent to the release of the information.Condition 5 allows processing where information contained in the personal data has been made public as a result of steps deliberately taken by the data subject. Neither of these conditions has been met in this case.
37.The Commissioner has gone on to consider all of the other conditions in Schedule 3, including those in the Data Protection (Processing of Sensitive Personal Data) Order 2000 (the 2000 Order) made by the Secretary of State for the purposes of condition 10 of Schedule 3. Having done so, he remains satisfied that there are no conditions in Schedule 3 which would allow the information to be disclosed. Consequently, he is satisfied that disclosure of any of the sensitive personal data withheld would breach the first data protection principle.
38.As the Commissioner is satisfied that there are no conditions in Schedule 3 which would permit the disclosure of the information, he is not required to go on to consider whether any of the conditions in Schedule 2 can be met in relation to the sensitive personal data or whether the disclosure of the sensitive personal data would otherwise be fair and lawful.
39.The Commissioner therefore finds that the Board was correct to withhold such information under section 38(1)(b) of FOISA.
Non-sensitive personal data
40.The Commissioner went on to consider the remaining personal data withheld, which does not fall into the category of "sensitive personal data".Again, the Commissioner considered whether disclosure of this information would breach the first data protection principle.
41.As noted above, the first data protection principle includes three separate aspects: (i) fairness, (ii) lawfulness and (iii) the conditions in the schedules.However, these three aspects are in many ways connected.For example, if there is a specific condition which permits the personal data to be disclosed, it is likely that the disclosure will also be fair.The Commissioner first considered the conditions listed in Schedule 2 of the DPA.
42.The Commissioner considers that only condition 6(1) of Schedule 2 to the DPA might be considered to apply in this case. Condition 6(1) allows personal data to be processed (in this case, disclosed in response to Mr C's information request) if disclosure of the data is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
43.There are a number of tests which must be considered before condition 6(1) can apply:
? Does Mr C have a legitimate interest in having this personal data?
? If so, is disclosure of the information necessary to achieve those legitimate aims? In other words, is disclosure proportionate as a means and fairly balanced as to ends, or could these legitimate aims be achieved by means which interfere less with the privacy of the data subject (the GP)?
? Even if the processing (i.e. disclosure) is necessary for the legitimate purposes of the applicant, would it nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subject? This will involve a balancing exercise between the legitimate interests of Mr C and those of the data subject. Only if (or to the extent that) the legitimate interests of Mr C outweigh those of the data subject can the personal data be disclosed.
Does the applicant have a legitimate interest?
44.Mr C has explained that initially he asked for the information because there was gossip and rumour about the decision taken by the GMC, and he wished to make decisions about his healthcare on an informed basis.He pointed out that in a remote rural area the decision to change doctors was not taken lightly, but he felt that it was fundamental that a person should have absolute confidence in their GP.He reiterated that he was not asking for "personal information" about the GP or any person who had complained, but only wanted sufficient information about the circumstances to enable him to reach an informed decision about whether to remain with the GP.
45.The Commissioner notes that in its letter of 11 December 2008, the Board advised Mr C that the GP had resigned from the practice, and that, in the short term, Primary Care Services for the practice would be provided through locum doctors until a permanent solution was found.
46.In deciding whether the Health Board complied with FOISA in withholding information from Mr C, the Commissioner must consider whether the exemption in section 38(1)(b) applied at the time of the Health Board's review of Mr C's request.In other words, he must take into account the change of circumstances created by the GP's resignation from the practice.
47.The Commissioner accepts that when Mr C submitted his information request on 21 September 2008, he had a legitimate interest in obtaining information which would enable him to reach a decision about his healthcare.However, the Commissioner finds that this legitimate interest, in as much as it related to information about his GP, ceased to exist once he had been informed that the GP had resigned from the practice.At that point, disclosure of personal data relating to the GP could no longer be relevant to any decision Mr C had to take about his future healthcare provision.
48.In his application to the Commissioner, Mr C noted:
"Since the GP concerned has now left the practice this is not about him particularly.It is about a fundamental principle and a fundamental right for a patient."
49.As noted above, the Commissioner accepts that Mr C had a legitimate interest in information which would enable him to reach a decision about his healthcare.However, the information covered by his request is, without exception, the personal data of the GP concerned.The Commissioner's decision in this case must therefore take into account the legal protection afforded to such information by the DPA, in deciding whether the exemption in section 38(1)(b) of FOISA was correctly applied by the Health Board.As explained in paragraphs 41 to 43, there are certain tests which determine whether the information can be disclosed without breaching any of the data protection principles in the DPA.If these tests cannot be met, there can be no lawful disclosure of the information.
50.It should be noted, however, that even if the Commissioner had found that Mr C had a legitimate interest in this information, it is not necessarily the case that information about the GP would have been disclosed.The Commissioner would still have been required to go on to consider whether disclosure was necessary to meet those interests and to have carried out the balancing act referred to in paragraph 43 above.
51.As the Commissioner has found that Mr C's legitimate interest in the GP's personal data ceased to exist once it was known that the GP had resigned from his practice, he must conclude that Condition 6(1) of Schedule 2 to the DPA does not apply, and that disclosure of the information would contravene the first data protection principle.The Commissioner therefore finds that the Board was correct to withhold the information under section 38(1)(b) of FOISA.
Failure to comply with timescales in FOISA
52.Section 21(1) of FOISA gives authorities a maximum of 20 working days following the receipt of the requirement to comply with a requirement for review, subject to exceptions which are not applicable here.
53.Paragraphs 3 to 6 of this decision notice describe events following Mr C's request for review, which he made on 13 October 2008.On 27 November 2008, the Board advised that it was unable to issue a response within 20 working days (as required by section 21(1) of FOISA).After a further reminder from Mr C, the Board finally issued its review response, dated 11 December 2008, on 15 December 2008.
54.The Board dealt with Mr C's request for review under the NHS Complaints Procedure, and sent Mr C a leaflet headed "Making a complaint about the NHS".While there is nothing in FOISA which would prevent a Scottish public authority from using its complaints procedure to progress a request for review under section 20(1) of FOISA, it is important that the public authority makes it clear to the applicant that their request for review will be dealt with in accordance with the provisions in FOISA rather than any other criteria.
55.The Commissioner finds that the Board failed to respond to Mr C's request for review within the 20 working days allowed under section 21(1) of FOISA. In failing to comply with this timescale, the Board failed to comply with Part 1 of FOISA. The Commissioner recommends that the Board should consider whether its procedures for carrying out reviews under FOISA require revision to ensure that the statutory timescale is observed in future.
DECISION
The Commissioner finds that NHS Highland (the Board) partially complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by Mr C.
The Commissioner finds that the Board correctly withheld the information under section 38(1)(b) of FOISA.However, he finds that the Board failed to comply with the requirements of section 17(1) of FOISA, in failing to give notice that it did not hold information relating to part of Mr C's request and failed to respond to Mr C's request for review within the timescales specified in section 21(1). In failing to do so, the Board breached Part 1 of FOISA. The Commissioner does not require the Board to take any action in respect of these breaches in response to this particular application.
Appeal
Should either Mr C or the Board wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only.Any such appeal must be made within 42 days after the date of intimation of this decision notice.
Margaret Keyse
Head of Enforcement
28 September 2009
Appendix
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
(?)
(6) This section is subject to sections 2, 9, 12 and 14.
2 Effect of exemptions
(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that ?
(a) the provision does not confer absolute exemption; and
(b) in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.
(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption ?
(?)
(e) in subsection (1) of section 38 ?
(?)
(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.
17 Notice that information is not held
(1) Where-
(a) a Scottish public authority receives a request which would require it either-
(i) to comply with section 1(1); or
(ii) to determine any question arising by virtue of paragraph (a) or (b) of section 2(1),
if it held the information to which the request relates; but
(b) the authority does not hold that information,
it must, within the time allowed by or by virtue of section 10 for complying with the request, give the applicant notice in writing that it does not hold it.
21 Review by Scottish public authority
(1) Subject to subsection (2), a Scottish public authority receiving a requirement for review must (unless that requirement is withdrawn or is as mentioned in subsection (8)) comply promptly; and in any event by not later than the twentieth working day after receipt by it of the requirement.
38 Personal information
(1) Information is exempt information if it constitutes-
(?)
(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;
(?)
(2) The first condition is-
(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-
(i) any of the data protection principles; or
(?)
(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.
(?)
Data Protection Act 1998
1 Basic interpretative provisions
In this Act, unless the context otherwise requires ?
?
"personal data" means data which relate to a living individual who can be identified ?
(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;
?
2Sensitive personal data
In this Act "sensitive personal data" means personal data consisting of information as to?
(a) the racial or ethnic origin of the data subject,
(b) his political opinions,
(c) his religious beliefs or other beliefs of a similar nature,
(d) whether he is a member of a trade union (within the meaning of the [1992 c. 52.] Trade Union and Labour Relations (Consolidation) Act 1992),
(e) his physical or mental health or condition,
(f) his sexual life,
(g) the commission or alleged commission by him of any offence, or
(h) any proceedings for any offence committed or alleged to have been committed by him, the disposal of such proceedings or the sentence of any court in such proceedings.
Schedule 1 ? The data protection principles
Part I ? The principles
1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless ?
(a) at least one of the conditions in Schedule 2 is met, and
(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
Schedule 2 ? Conditions relevant for purposes of the first principle: processing of any personal data
...
6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
?
Schedule 3 ? Conditions relevant for purposes of the first principle: processing of sensitive personal data
1. The data subject has given his explicit consent to the processing of the personal data.
?
5. The information contained in the personal data has been made public as a result of steps deliberately taken by the data subject.
?
[1] http://www.itspublicknowledge.info/Law/FOISA-EIRsGuidance/section38/Section38.aspx
