One problem which arises is what to do about data which relates to more than one individual – a so called ‘mixed data’ case. The Court of Appeal recently considered this issue in the case of B v General Medical Council.

The case concerned a report regarding the competence of a doctor who had failed to diagnose bladder cancer. The report had been commissioned by the General Medical Council (GMC) and it contained information about both the patient and the doctor. The doctor challenged the decision of the GMC to disclose the report on various grounds, including the fact that the report contained information about him.

The Court of Appeal rejected the challenge and held that the GMC had been correct to disclose the document to the patient, even though it contained information regarding the doctor.

Of particular note the Court of Appeal held:

1. There is no presumption against disclosure in a ‘mixed data’ case. The rights of both people mentioned in the report had to be considered; and
2. The fact that someone is seeking information which may assist in litigation is irrelevant.

The Court also said that data controllers may wish to consider whether it would be reasonable to allow disclosure on the proviso that a binding contractual undertaking is provided that the information will not be disseminated more widely.

Although not a case which involved an employer – employee relationship, the ruling of the Court of Appeal will be applicable in employment cases. The employment team’s experience is that subject access requests are a tool frequently used by employees who are in dispute with their employer and they should be carefully handled, not least because of the possibility of a significant fine if handled incorrectly. Our longstanding advice is that our clients should always be very careful what they commit to writing, in case it subsequently has to be disclosed and is misinterpreted (or in some cases, correctly interpreted!)

Although this case was based upon a subject access request which was made prior to the GDPR coming into force, the principles set down by the Court will apply in the GDPR era.

Many of you have watched the GDPR webinar produced by the employment team in February of this year. If you haven’t yet seen it and would like to, please get in touch with your usual contact in the employment team. If you are not yet fully compliant with the GDPR, or are unsure whether you are compliant, we also have a range of templates which can help you to comply and we are of course on hand to provide bespoke advice.