Lynn Wyeth discusses the key takeaways from some recent FOI and Data Protection cases.
This month, I’m looking at one Data Protection Decision Notice and a regularly recurring FOI request for local authorities. Let’s start with the data protection decision:
Data Protection
Can an NHS Trust keep and share patient records with the patient’s GP, family, and school without consent?
This case will be of particular interest for anyone involved in multi-agency sharing, particularly of special category data such as health data (including mental health data). It has broad implications for health and social care providers. Remember, however, that each case must be assessed on its own merits
A former NHS patient (granted anonymity) sued the NHS Trust, claiming it unlawfully kept and shared his personal data, which mainly consisted of mental health records. He said medical records were shared with his GP, family, and school without consent, included inaccuracies (like a possible autism diagnosis), and were kept for too long (20 years), breaching the data protection principle for retention and his privacy rights under the European Convention on Human Rights.
His claim for £200,000 was unsuccessful. The court said the NHS Trust had a lawful reason to process his health data, as providing healthcare is a public function undertaken in the public interest.
The judge also ruled that the 20-year retention policy was lawful and proportionate. It was based on expert advice and served both the individual’s and the public’s interests. Keeping the records helped ensure proper care if the patient needed treatment again and allowed the Trust to defend itself if there was future legal action.
In summary, the judgment gave us lines to take on the following data protection issues:
Lawful Basis:
- The NHS Trust had a valid legal basis under Article 5(1)(e) UK GDPR for processing the claimant’s records — it was necessary for tasks carried out in the public interest.
- It also met the conditions under Article 9(2)(h) and (i) (health and public interest) and Article 9(3)(medical confidentiality).
Risk Assessments from Police:
- ‘Adult at risk’ reports shared by police were processed lawfully.
- Article 13 (right to be informed/privacy notice) does not require that individuals be notified every time personal data is received.
Right to Erasure:
- The claimant had no right to have his records deleted under Article 17 UK GDPR because the NHS Trust had a lawful reason to keep processing them.
Retention Period:
- The NHSX policy to keep mental health records for 20 years was lawful and proportionate based on expert advice and met public health needs.
- Any impact on privacy rights under Article 8 of the European Convention on Human Rights was minor and justified.
Accuracy:
- Diagnoses, such as a possible autism diagnosis, are medical and clinical opinions, not factual inaccuracies, and, therefore, they do not breach the data accuracy requirement under Article 5(1)(d) UK GDPR.
The full decision can be read here.
Freedom of Information
Non-payment of council tax by elected members.
This is a regular Freedom of Information request which is submitted to local authorities. It still results in different responses despite an Upper Tribunal case having discussed it at length.
Can a council reveal to the requester which Elected Members (councillors) are in arrears with their council tax payments, or can the public authority use the exemption under s40(2) or s40(5) citing the personal data exemption?
The Information Commissioner regularly references the Upper Tribunal’s decision in DH v Information Commissioner and Bolton Council,[2016] UKUT 139 (AAC), which found that the name of an Elected Member who had failed to pay council tax should be disclosed. The Commissioner must be persuaded that the personal circumstances are exceptional for names not to be released.
Why? Because section 106 of the Local Government Finance Act 1992 states that an Elected Member who is two or more months in arrears with payment of Council Tax must declare his/her arrears and not vote at certain budget type meetings. In addition, we have the arguments that elected officials and law makers are more accountable, should not break the law and should be role models.
The ICO uses the case as a learning point on its website. “The legitimate interests in disclosure can outweigh the individuals’ rights and freedoms, where there’s a high expectation of scrutiny and accountability.”
Despite the ICO guidance, and the Tribunal ruling in 2016, in April 2024 the ICO again issued a decision notice saying names should be released, this time against Liverpool City Council.
Durham and Newcastle councils are currently having their latest refusals appealed by the Local Democracy Reporting Service as they continue to refuse to name councillors. Sunderland also refused to reveal any names.
Some councils continue to rely on s40(2) and s40(5), often without presenting compelling reasons why their councillors’ situations are exceptional. Others disclose the names routinely, following the precedent and ICO guidance. The ICO’s consistent stance inboth guidance and decisions is that transparency generally prevails, and public authorities must justify any deviation with robust, case-specific evidence that meets a high threshold (e.g. safeguarding or medical reasons).
Want more guidance and advice on best practice – check out our on demand webinars
