Dr B v GMC (2018) EWCA Civ 1497 is a “mixed data case”. The majority of the Court of Appeal has ruled that in such a case there is no presumption under the DPA of non-disclosure. Sales LJ said:-
“70. … , I do not think that the balancing regime in section 7(4)-(6) of the DPA includes any presumptive starting point or hurdle which either the requestor or the objector has to overcome. The circumstances in which the balancing exercise has to be carried out from case to case will be many and varied, and where no consent has been given for disclosure (or where objection has been raised, as in this case) the outcome of the exercise will inevitably depend on the particular facts and context. The question is simply whether “it is reasonable in all the circumstances to comply with the [SAR] without the consent of the other individual” (section 7(4)(b)). Although section 7(6) specifies that regard should be had to certain listed matters “in particular”, it does not limit the other matters which may be relevant circumstances; nor does it specify the weight to be given to the listed matters either as between the items in the list or as against other, non-listed relevant circumstances. There is no sound basis for saying that one should load the exercise at the outset in favour of either the objector or the requester. The rights and interests engaged on each side are both rooted in Article 8 of the ECHR and in specific protective provisions in the Directive. Both sets of rights and interests are important and there is no simple or obvious priority as between them which emerges from consideration of their nature or their place in the legislative regime. …
- It is conceivable, but in practice I think unlikely, that a data controller who carries out the balancing exercise in section 7(4)-(6) in a mixed data case might be left with factors for and against disclosure which are found to be in perfect equilibrium with nothing to choose between them. In that situation there would be a need to apply a presumption at the end of the exercise, in order to arrive at a decision one way or the other. In my view, the presumption to be applied at this stage would be in favour of withholding disclosure. I emphasise that this would be a presumption of the weak, tie-breaker type referred to above. It is not a significant or substantive presumption to be applied at the outset.
- My reason for saying that the tie-breaker assumption operates in favour of the third party data subject, rather than the requestor in this situation is that, although section 7(1) of the DPA creates a right for the data subject as against the data controller to have his personal data disclosed to him upon making a SAR, by virtue of section 7(4) the data controller is relieved of that obligation where information comprising those personal data cannot be disclosed “without disclosing information relating to another individual who can be identified from that information”, unless either of sub-paragraphs (a) or (b) is satisfied. As regards sub-paragraph (b), it must appear that it is “reasonable in all the circumstances to comply with the request without the consent of the other individual”; that is to say, having regard to the strength of the interest of the requester (as reflected in the legislative regime set out in the Directive and the DPA) in obtaining disclosure, to the strength of the interest of the objector in maintaining his privacy in relation to the information in question and to any further public interest factors which may be relevant. If the considerations for and against disclosure really are precisely balanced, the data controller (or anyone else applying the test in section 7(4)) cannot positively say that it is reasonable to comply without the consent of the other individual. This indicates that the tie-break presumption should operate in this residual sense against disclosure.”
The Court of Appeal also considered the issue of principle as to what weight (if any) should be given to the motivation of a person in making a SAR in a mixed data case, where the motive or part of the motive is to seek to obtain information which might assist the requester in litigation against the objector. Sales LJ said:-
“79. In my view, there is no general principle that the interests of the requester, when balanced against the interests of the objector, should be treated as devalued by reason of such motivation. The general position is that the rights of subject access to personal data under Article 12 of the Directive and section 7 of the DPA are not dependent on appropriate motivation on the part of the requester: … Moreover, where a person has two rights to obtain something (here, access to information), the usual position is that he is entitled to rely on whichever right is the more effective from his point of view. On the other hand, when carrying out the balancing exercise under section 7(4) in a mixed data case, it will be relevant to have regard to the extent to which the interests on either side which are of a kind which are protected by the legislation are engaged and may be prejudiced by a decision one way or the other.”
“82. … in a mixed data case where … a data controller gives the objector a full opportunity to state his grounds of objection to disclosure, the data controller will generally be entitled to focus on the objector’s arguments in evaluating his interest in having disclosure withheld. The data controller does not have to cast around for further reasons which have not been raised by the objector, at any rate so long as they are not matters which are so obvious that they must be taken into account in the balancing exercise under section 7(4) whether raised or not. …”