Giovanni Marcheselli v The Information Commissioner & Anor
[2023] UKFTT 76 (GRC)
Andy Kimber v The Information Commissioner & Anor
16 August 2023
[2023] UKFTT 675 (GRC)
First-tier Tribunal
Someone complained about a doctor. They then asked for the qualifications of the person who investigated the complaint. The GMC and the Information Commissioner said no, because confirming or denying would reveal who complained, violating the doctor's privacy. The court agreed.
Key Facts
- •Andy Kimber requested information from the General Medical Council (GMC) about the qualifications of the person who investigated a complaint he made against a doctor (referred to as 'person A').
- •The GMC neither confirmed nor denied whether it held the requested information, relying on section 40(5B) of the Freedom of Information Act 2000 (FOIA) and data protection principles.
- •The Information Commissioner upheld the GMC's decision.
- •Kimber appealed to the First-tier Tribunal (General Regulatory Chamber).
Legal Principles
Freedom of Information Act 2000 (FOIA) exemptions, specifically section 40(5B)(a)(i), allows withholding of information if confirmation or denial would contravene data protection principles.
FOIA
Data Protection Act 2018 and UK GDPR Article 5(1)(a): Personal data shall be processed lawfully, fairly and in a transparent manner.
UK GDPR and DPA 2018
UK GDPR Article 6(1)(f): Processing of personal data is lawful if necessary for the purposes of the legitimate interests pursued by the controller or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject.
UK GDPR
Definition of 'personal data' under DPA 2018, relating to identifiable living individuals.
DPA 2018
Outcomes
The appeal was dismissed.
The Tribunal found that confirming or denying whether the GMC held the requested information would disclose personal data (that a complaint had been made against person A), breaching data protection principles. The legitimate interest in disclosure was outweighed by the data subject's (person A's) right to privacy.