[Home] [Databases] [World Law] [Multidatabase Search] [Help] [Feedback]
	First-tier Tribunal (General Regulatory Chamber)
You are here: BAILII >> Databases >> First-tier Tribunal (General Regulatory Chamber) >> Kimber v Information Commissioner [2023] UKFTT 675 (GRC) (16 August 2023) URL: http://www.bailii.org/uk/cases/UKFTT/GRC/2023/675.html Cite as: [2023] UKFTT 675 (GRC)

[New search] [Printable PDF version] [Help]

First-tier Tribunal
(General Regulatory Chamber)
Information Rights

		Heard by video On 14 August 2023
		Decision Given On: 16 August 2023

DECISION
1. The appeal is dismissed.
2. The decision to neither confirm nor deny whether the requested information is held pursuant to section 40(5B) of the Freedom of Information Act 2000 (FOIA) is confirmed.
REASONS

Background

3. On 4 July 2022 Mr Kimber submitted a request for information (the request) to the General Medical Council (GMC) who is the second respondent to this appeal, under section 1 of FOIA in the following terms:

Please provide a full list of the professional qualifications and professional faculty /body registrations of the anonymous professional person who investigated a case related to the redacted name in this request. The GMC should include any medical qualifications and registrations, any legal qualifications and registrations and any other professional qualifications in the answer to the request.

4. On the same date Mr Kimber made two further requests for information. We do not set them out in full here, because they were not in issue in the appeal and therefore it is not necessary to do so. They are contained at pages F214 and F215 of the appeal bundle respectively.
5. On 5 July 2022 the GMC responded to all three requests. In respect of the first request, the GMC neither confirmed nor denied that it held the requested information, relying on section 40(5B)(a)(i) of FOIA on the basis that confirming or denying the existence of the information would breach the first principle of processing personal data and that there is no legal basis for disclosure under article 6 of UK GDPR.
6. On 8 July 2022 Mr Kimber requested a review of the response. This was carried out, and on 8 August 2022 the GMC maintained its decision.
7. Mr Kimber then complained to the Information Commissioner (the Commissioner). The GMC provided submissions to the Commissioner and on 18 November 2022 the Commissioner issued the decision notice which is challenged in this appeal.

The respondent's decision

8. The Commissioner's reasons are set out in the decision notice dated 18 November 2022 and can be summarised as follows:

• Confirming or denying the existence of the requested information would constitute the disclosure of a third party's personal data which, in this case, is whether a complaint had been made about a particular doctor.

• Providing such data would contravene the data protection principle set out in article 5(1)(a) of UK GDPR because disclosure would not be lawful, or fair.

• It is accepted that there is a legitimate interest in disclosure of the requested information.

• It is accepted that in order to meet the legitimate interest it is necessary to confirm or deny whether the requested information is held.

• The legitimate interest is not sufficiently strong to outweigh the data subject's fundamental rights and freedoms.

• Disclosure would not be lawful because none of the conditions of article 6 of UK GDPR are satisfied, article 6(1)(f) being the most appropriate.

The appellant's case

9. Mr Kimber's grounds of appeal can be summarised as follows:

• The Commissioner is confused as to the data subject. It is not the particular doctor against whom he made a complaint (person A), but is the person at the GMC who investigated that complaint (person B).

• He does not know the identity of person B and in so far as the decision notice suggests that he does, that is not correct.

• Any discussion about the identity of or possible identification of person A is irrelevant.

• Professional qualifications are not personal information when the information relates directly to their competence to undertake a professional matter.

• The identity of person B should be disclosed.

The hearing

10. The hearing was conducted by video using Cloud Video Platform. There was no objection to this method of hearing and we are satisfied that it was appropriate and allowed the parties to participate effectively.
11. On 10 August 2023 the tribunal received a notice from Mr Kimber seeking to withdraw his appeal. We did not consent to the withdrawal, directing instead that Mr Kimber could make his application on the day of the hearing. The reason for this was that the notice of withdrawal was unclear, as Mr Kimber indicated that all issues in the appeal remained live and that he did not agree that they should no longer be determined. In his notice of withdrawal Mr Kimber expressed various concerns about the appeal and whether or not it was procedurally fair. He was concerned about case management directions, particularly those made on 10 July 2023.
12. In respect of Mr Kimber's concerns about those case management directions made prior to the hearing, we noted that withdrawing his appeal would have no effect on them. They would continue to exist. We explained that the case management directions were relevant only to getting his appeal to the point of being ready for hearing. In relation to his concern that the case management directions may be disclosed to an unspecified court in unspecified future legal proceedings, we reiterated advice given previously that documents relating to his appeal would only be disclosed following an application and only by order from a judge. Whether he continued with his appeal would have no material effect on this process.
13. We advised Mr Kimber that to withdraw his appeal meant that the tribunal would not make a decision. We indicated that he had three options open to him in light of the concerns he had raised:

(i) That he could withdraw his appeal with the result that the tribunal would make no decision on the issues and the appeal would come to an end.

(ii) He could continue with his appeal and that it would be determined following the hearing in which he could participate or not as he chose. It was noted that in the event he chose not to participate, the tribunal would still hear submission from the GMC and take them into account in reaching its decision, but that he would not have the opportunity to respond.

(iii) He could seek to have the appeal determined on the papers without a hearing absent any objection by the Commissioner or the GMC, in which case the tribunal would not hear oral submissions from any party and would determine the appeal solely on the basis of the documents before it.

14. Mr Kimber elected to proceed with his appeal and participated actively in the hearing. During the hearing it became apparent that Mr Kimber did not have the full appeal bundle. The tribunal emailed a copy to him during the hearing so that he could make reference to it and follow Ms Emmerson's submissions. The tribunal also emailed him a copy of the authorities bundle for the sake of ensuring that he could make reference to it if necessary.
15. Mr Kimber's case was clearly set out in the grounds of appeal and the tribunal therefore heard from Ms Emmerson before giving Mr Kimber a chance to make submissions in response. At the end of the hearing we reserved our decision which we give now, the reasons for which are set out below.
16. In reaching our decision we considered the oral submissions together with the following documents:

(i) The hearing bundle comprising 273 pages.

(ii) The bundle of authorities comprising 157 pages.

17. We note that the Commissioner was not represented at the hearing on the basis that he could add little to the written submissions or the submissions made on behalf of the GMC. It is for this reason that we refer throughout to the submissions of the GMC – in doing so, we should not be taken to have ignored the written submissions of the Commissioner. They have formed part of our consideration of this appeal.

The law

18. Section 2 of FOIA provides where relevant:

2.—Effect of the exemptions in Part II

(2) In respect of any information which is exempt information by virtue of any provision of Part II, section 1(1)(b) does not apply if or to the extent that—

(a) the information is exempt information by virtue of a provision conferring absolute exemption, or

(b) in all the circumstances of the case, the public interest in maintaining the exemption outweighs the public interest in disclosing the information.

(3) For the purposes of this section, the following provisions of Part II (and no others) are to be regarded as conferring absolute exemption—

…

(fa) section 40(2) so far as relating to cases where the first condition referred to in that subsection is satisfied.

19. Section 40 provides where relevant:

40.—Personal information.

…

(2) Any information to which a request for information relates is also exempt information if—

(a) it constitutes personal data which [does] 1 not fall within subsection (1), and

(b) the first, second or third condition below is satisfied.

(3A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act—

(a) would contravene any of the data protection principles, or.

…

(5B) The duty to confirm or deny does not arise in relation to other information if or to the extent that any of the following applies—

(a) giving a member of the public the confirmation or denial that would have to be given to comply with section 1(1)(a)—

(i) would (apart from this Act) contravene any of the data protection principles, or

(7) In this section—

'the data protection principles' means the principles set out in—

(a) Article 5(1) of the UK GDPR , and

(b) section 34(1) of the Data Protection Act 2018;

'data subject' has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);

'personal data' and 'processing' have the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2), (4) and (14) of that Act);

'the UK GDPR' has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(10) and (14) of that Act).

20. Section 3 of the DPA provides where relevant:

3.—Terms relating to the processing of personal data

(2) 'Personal data' means any information relating to an identified or identifiable living individual (subject to subsection (14)(c)).

(3) 'Identifiable living individual' means a living individual who can be identified, directly or indirectly, in particular by reference to—

(a) an identifier such as a name, an identification number, location data or an online identifier, or

(b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual.

21. Articles 5 and 6 of the UK GDPR provide where relevant:

Article 5

(1) Personal data shall be:

(a) processed lawfully, fairly and in a transparent manner in relation to the data subject ('lawfulness, fairness and transparency');

Article 6

(1) Processing shall be lawful only if and to the extent that at least one of the following applies:

…

(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Findings and reasons

22. The issue for determination in this appeal is whether the GMC was entitled to neither confirm nor deny that it held the requested information. It is important to understand that if the answer to this question is in the affirmative, it will not automatically result in the disclosure of the information requested by Mr Kimber. To decide the main issue, it is necessary to answer the following questions:

(i) What is the scope of the appellant's request for information?

(ii) Would confirmation or denial that the information is held result in the disclosure of personal data of a third party (i.e. person A)?

(iii) Would confirmation or denial that the information is held be in breach of data protection principles, i.e. would it be unlawful and/or unfair? There are three separate questions relevant to determining whether it would be lawful:

(a) Is there a legitimate interest being pursued?

(b) Is disclosure (i.e. confirmation or denial) necessary to achieve the legitimate interest?

(c) Is the legitimate interest overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data?

What is the scope of the appellant's request for information?

23. In his notice of appeal and in his oral submissions Mr Kimber argued that he has clearly requested the identity of person B. We find for the purposes of this appeal that he has not. Mr Kimber had previously requested the identity of person B and has been refused that information. We note what he says in the notice of appeal about this. This is further supported by the GMC's email to Mr Kimber dated 5 July 2022 (page C119, appeal bundle), in which it is stated:

I am in receipt of your eight emails from yesterday.

I believe that three of them contain new requests and I will respond to them first, under the Freedom of Information Act 2000.

I do not believe that any of your emails express a wish to appeal my first decision, please let me know if I have missed such a request.

24. The GMC therefore treated the three emails dated 4 July 2022 as containing requests for information made pursuant to FOIA and they are the three requests to which the decision notice dated 18 November 2022 relates and which is challenged in this appeal. There is no request for the identity of person B in any of those three requests.
25. We find that the scope of the request for information which is relevant for the purposes of this appeal is limited to a list of the professional qualifications and professional faculty/body registrations of person B, including any medical qualifications and registrations, any legal qualifications and registrations and any other professional qualifications (the professional qualifications).

Would disclosure result in disclosure of personal data of a third party?

26. The personal data in this context is the information that there had been a complaint against person A. There was no dispute that this does amount to personal data and we find that it does. It is any information relating to an identified or identifiable living individual.
27. The GMC argues that the request for information would lead to the disclosure of personal data about a third party because the request cannot be looked at in isolation. The GMC argues that the context of the request must also be considered. The context of the request in this case is that Mr Kimber made a complaint to the GMC about person A, which was considered by person B. He was dissatisfied with the outcome of that complaint and wishes to know the qualifications of person B. Ms Emmerson submitted that it would be necessary to refer to Mr Kimber's complaint because, as he did not name person B in his request, there would be no way of identifying whose professional qualifications were being requested. If regard was not had to the complaint, the request for information would be meaningless.
28. For that reason, the GMC's position is that confirming or denying the existence of the requested information would amount to disclosure that there had been a complaint made about person A.
29. Mr Kimber argues that disclosing the professional qualifications of person B could not identify or lead to the identification of person A. He argues that because he does not know the identify of person B, he could not identify them to the public, thereby leading to the identification of person A. He further argues that his request could be answered by the respondent simply providing the details of the individual's professional qualifications without identifying person A or person B.
30. The GMC relied on various cases which are contained in the authorities bundle and which Ms Emmerson summarised in her submissions. We have considered the decisions in all of those cases. The Upper Tribunal considered each of the cases relied on in Myhill v IC and GMC [2022 UKUT 207 (AAC) and found that they had all been correctly decided. One case which is particularly relevant for the purposes of this appeal is that of Rushbrooke v IC and GMC (EA/2020/1050V). The appellant in Rushbrooke had made a complaint to the GMC about a doctor (i.e. person A) and contained in the correspondence relating to the complaint was a request for the professional qualifications of the assistant registrar at the GMC who had considered that complaint (i.e. person B). She was advised to make her request to the GMC's Information Access Team, which she did.
31. In considering the request the GMC refused to confirm or deny it held the information. The Commissioner upheld the GMC's decision and in the decision notice the Commissioner stated that the appellant named a doctor in her correspondence with the GMC associated with her request. The Commissioner stated in the decision notice:

22… the Commissioner considers that the request of 8 February 2019 needs to be read as part of the wider email chain. In order to identify what information is being sought, it is necessary to read the request in the context of the earlier emails. This would involve identifying a doctor.

23. The Commissioner is therefore satisfied that the doctor in this case could be identified if the GMC confirmed or denied it holds the requested information; that is the qualifications of an AR who made a decision not to review how the GMC had handled a complaint. The Commissioner understands the doctor concerned to be alive, and whether he or she has had a complaint submitted about them is that doctor's personal data because such information is about them and is used to inform decisions about them.

24. As such, the Commissioner is satisfied that confirming or denying the information is held would constitute disclosure of a third party's personal data, that of a doctor.

32. In the present case Mr Kimber does not name person A in his request. He does however name person A in his correspondence relating to the request and this appeal. This is contained in the appeal bundle. It is clear from the appellant's email dated 5 July 2022 sent at 18:52 (page C125, appeal bundle) that his FOIA requests are inextricably connected to his complaint about person A and his dissatisfaction with the outcome of that process. He stated:

Even if there is no merit to my FOI requests I am then lacking any safe or reasonable way of addressing these very serious issues. So I would appeal to the GMC to help me, or I will have to keep doing what I can to seek justice and, frankly, seek safe and evidence based medical reviews of my health to try to address the GMCs abusive, prejudicial and evidentially unsupportable investigations.

All of the FOIs are simply trying to understand what the GMC investigations into my case really constitute - are these claimed by the GMC to be clinical investigations or are they a defence of your doctors? The investigations carried out by the GMC into my case are lacking in any clinical evidence and take a very adversarial angle against me as a patient and act to defend your doctors. (Emphasis added)

33. This is further illustrated in the GMC's email in which the outcome of the internal review of the FOIA response is set out (page C127, appeal bundle). It is stated:

I write further to your email correspondence below. On 8 July 2022 you indicated that you wished to appeal all responses provided under the Freedom of Information Act 2000 (FOIA). For your reference these are IR1-3605476798, IR1-3605476785 and IR1-3605476771.

As I had mentioned in my email of the same date an appeal would only extend to whether we have responded appropriately under FOIA and that we wouldn't be in a position to address the wider concerns you raise.

34. We find that in the present case, it would not have been possible for the GMC to respond to Mr Kimber's request without having regard to the previous correspondence relating to his complaint. Without having regard to that, there would have been no way of identifying whose professional qualifications were being requested and the request would have been meaningless.
35. We note that although disclosure is always made to the person making the request, once such a request has been complied with, the information is in the public domain. It is no longer protected by any confidentiality which it had prior to disclosure. This is the reason for the existence of the exemption from disclosure.
36. We find that even if Mr Kimber's request made on 4 July 2022 could be viewed in isolation, there would be nothing to stop him publishing all email correspondence between himself and the GMC including any response to his request, which would immediately identify whether a complaint had been made against person A.
37. For all of these reasons we find that confirmation as to whether the data is held would amount to a public disclosure that the GMC had received and considered a complaint against person A who is identified in the appellant's correspondence. This would amount to processing of the personal data of person A.

Would confirmation or denial that the information is held be in breach of data protection principles?

38. In determining this question we have had regard to articles 5 and 6 of the UK GDPR. To determine whether confirmation or denial would be lawful, we answer the following three questions:

(a) Is there a legitimate interest being pursued?

The Commissioner accepts that a legitimate interest is being pursued. We find that there is – namely knowing what concerns have been expressed over care being provided by doctors and how they have been addressed.

(b) Is disclosure (i.e. confirmation or denial) necessary to achieve the legitimate interest?

Again, the Commissioner accepts that confirmation or denial is necessary to achieve the legitimate interest because there are no less intrusive means available.

Ms Emmerson accepted that there is a legitimate interest, but contended on behalf of the GMC that the legitimate interest is in reality a limited one. This is because the requested information would shed little or no light on whether there are meaningful concerns about person A's fitness to practice, or how such concerns were investigated; only that a complaint had been made. Ms Emmerson contended that Mr Kimber would have had an alternative means of obtaining the requested information, i.e. in the course of a challenge to the GMC's decision in his complaint by way of a claim for judicial review. She pointed out that such a challenge would be governed by its own disclosure rules whereby the requested information may be disclosed for the limited purpose of the proceedings rather than to the world at large which is the effect of disclosure under FOIA.

Having considered the submissions, we find that disclosure is necessary to achieve the legitimate interest. There may be many reasons why Mr Kimber did not seek to challenge the GMC's decision at the time, we cannot speculate as to those. To pursue a claim for judicial review solely for the purpose of obtaining information is in our view neither reasonable nor appropriate.

(c) Is the legitimate interest overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data?

We have had regard to the GMC's Publication and disclosure policy Fitness to practise dated 7 September 2020 (page F243, appeal bundle), which sets out what information regarding a doctor's fitness to practise is published and where. It states:

The fact that a doctor is the subject of an investigation will not be routinely disclosed to general enquirers (apart from current or new employers/responsible officers) or the media unless and until a warning is issued, undertakings are agreed or a hearing takes place. The exception to this is where it is necessary for the MPTS to impose an interim order to restrict the doctor's practice as a precautionary measure.

The Commissioner took into account the following factors when conducting the balancing test required by article 6(1)(f):

the potential harm or distress that disclosure may cause;

whether the information is already in the public domain;

whether the information is already known to some individuals;

whether the individual expressed concern to the disclosure; and

the reasonable expectations of the individual.

The last of those factors was a key issue for the Commissioner and we agree that it carries significant weight. The GMC's Publication and Disclosure Policy creates a clear reasonable expectation by person A that their personal data would not be disclosed to the world at large, which would be the effect of confirming or denying that the information requested in relation to person B was held.

We are satisfied that disclosure (through confirmation or denial) would be reasonably likely to cause damage and distress to person A as a result of it being identified that they were the subject of a complaint to the GMC. The public knowing this information without knowing the outcome of the complaint is potentially reputationally damaging and distressing.

We did not have any evidence before us to suggest that the information is already in the public domain or known to some individuals or any evidence as to the views of person A.

For all of these reasons we find that the legitimate interest is overridden by the interests and/or fundamental rights and freedoms of person A.

39. We find therefore that disclosure through confirmation or denial of whether the requested information is held would be unlawful and therefore in breach of data protection principles. It follows that we uphold the Commissioner's decision.
40. As we have found that disclosure would be unlawful, there is no need for us to go on and consider whether it would be fair.

Signed

Date 15 August 2023

Judge J K Swaney

Judge of the First-tier Tribunal