Bridge McFarlandLLP

Personal
Legal Services
More Information
Bridge McFarland LLP can offer you practical, uncomplicated advice, support & guidance when you need it most. Whether it be an employment dispute, family advice, an accident or negligence, life planning or moving house, let us help you.
Business
Legal Services
More Information
Our commercial team in Lincoln, Hull, Market Rasen and Grimsby prides itself on its sound business sense, commercial insight, local knowledge and first class understanding of the relevant legal disciplines ranging from employment law, business contracts, dispute resolution to agriculture and property development. From company formation to sale, succession, dissolution or dispute resolution, you can trust our team to deliver first class service and results.
Photograph of Chris Gresswell-Green
Chris Gresswell-Green
Senior Solicitor
View Profile
Photograph of Janet Wilson
Janet Wilson
Senior Conveyancing Executive
View Profile
Photograph of Rob Ripley
Rob Ripley
Partner
View Profile
Photograph of Lee Whiting
Lee Whiting
Partner
View Profile
Photograph of Lisa Moore
Lisa Moore
Partner
View Profile
Photograph of Ian Sprakes
Ian Sprakes
Partner
View Profile
Photograph of Leanne Keating
Leanne Keating
Partner
View Profile
Photograph of Rob Ripley
Rob Ripley
Partner
View Profile
Photograph of Mike Wilson
Mike Wilson
Partner
View Profile
Photograph of Chris Hubbard
Chris Hubbard
Partner
View Profile
Photograph of Jacqui Johnson
Jacqui Johnson
Partner
View Profile
Home » Latest News » Court of Appeal gives guidance for dealing with subject access requests

Court of Appeal gives guidance for dealing with subject access requests

Court of Appeal gives guidance for dealing with subject access requests

Many of our readers will be familiar with subject access requests, whereby an employee makes a request for disclosure of information which is held about them. This right was enshrined in the Data Protection Act and continues in its successor, the GDPR.

One problem which arises is what to do about data which relates to more than one individual – a so called ‘mixed data’ case. The Court of Appeal recently considered this issue in the case of B v General Medical Council.

The case concerned a report regarding the competence of a doctor who had failed to diagnose bladder cancer. The report had been commissioned by the General Medical Council (GMC) and it contained information about both the patient and the doctor. The doctor challenged the decision of the GMC to disclose the report on various grounds, including the fact that the report contained information about him.

The Court of Appeal rejected the challenge and held that the GMC had been correct to disclose the document to the patient, even though it contained information regarding the doctor.

Of particular note the Court of Appeal held:

  1. There is no presumption against disclosure in a ‘mixed data’ case. The rights of both people mentioned in the report had to be considered; and
  2. The fact that someone is seeking information which may assist in litigation is irrelevant.

The Court also said that data controllers may wish to consider whether it would be reasonable to allow disclosure on the proviso that a binding contractual undertaking is provided that the information will not be disseminated more widely.

Although not a case which involved an employer – employee relationship, the ruling of the Court of Appeal will be applicable in employment cases. The employment team’s experience is that subject access requests are a tool frequently used by employees who are in dispute with their employer and they should be carefully handled, not least because of the possibility of a significant fine if handled incorrectly. Our longstanding advice is that our clients should always be very careful what they commit to writing, in case it subsequently has to be disclosed and is misinterpreted (or in some cases, correctly interpreted!)

Although this case was based upon a subject access request which was made prior to the GDPR coming into force, the principles set down by the Court will apply in the GDPR era.

Many of you have watched the GDPR webinar produced by the employment team in February of this year. If you haven’t yet seen it and would like to, please get in touch with your usual contact in the employment team. If you are not yet fully compliant with the GDPR, or are unsure whether you are compliant, we also have a range of templates which can help you to comply and we are of course on hand to provide bespoke advice.