W, X, Y And Z, R (on the application of) v The Secretary of State for Health & Ors [2015] EWCA Civ 1034

Case No C1/2014/1780[2015] EWCA Civ 1034
IN THE COURT OF APPEAL (CIVIL DIVISION)
[2014] EWHC 1532 (Admin)
ON APPEAL FROM THE ADMINISTRATIVE COURT
(MR JUSTICE SILBER)
Venue Royal Courts of Justice, Strand, London, WC2A 2LLDate 14 October 2015
Before
THE MASTER OF THE ROLLSLORD JUSTICE BRIGGSLORD JUSTICE BEAN
Between
The QueenAppellantsOn the application ofAppellantW, X, Y AND ZAppellantTHE SECRETARY OF STATE FOR HEALTHRespondentTHE SECRETARY OF STATE FOR THE HOME DEPARTMENTInterested PartyTHE BRITISH MEDICAL ASSOCIATIONIntervener
David Wolfe QC and Nick Armstrong (instructed by Deighton Pierce Glynn) for AppellantsMarie Demetriou QC and Sarah Abram (instructed by Government Legal Department) for RespondentJulie Anderson (instructed by Government Legal Department) for Interested PartyAnya Proops (instructed by BMA Legal Department) for IntervenerHearing Hearing dates : 20-21 July 2015
JUDGMENTThe Master of the Rolls:This is the judgment of the court.
[1]As a general rule, health services which are provided in England and Wales have to be provided free of charge. There is, however, an exception in the case of persons who are not ordinarily resident in the United Kingdom. The relevant charging powers are set out in the National Health Service (Charges to Overseas Visitors) Regulations 2011 (SI 2011/1556) as amended (“the Charging Regulations”). In 2011, the Secretary of State for Health (“the Secretary of State”) issued guidance on implementing the Charging Regulations (“the Guidance”). The Guidance has subsequently been amended, but the amendments are of little relevance for present purposes.[2]On 31 October 2011, the Immigration Rules (HC 385) were amended so as to introduce sanctions which, with certain exceptions, could be imposed on individuals who(i) are not resident in the United Kingdom,(ii) are seeking to enter or remain in the United Kingdom, but(iii) have unpaid NHS debts of at least £1,000. The purpose of the sanctions is to assist the NHS financially by supporting debt recovery and deterring the deliberate abuse of NHS services.[3]The relevant changes to the Immigration Rules introducing immigration sanctions came into effect on 31 October 2011. Rule 320(22) provides: "Grounds on which entry clearance or leave to enter the United Kingdom should normally be refused … where one or more relevant NHS body has notified the Secretary of State that the person seeking entry or leave to enter has failed to pay a charge or charges with a total value of at least £1000 in accordance with the relevant NHS regulations on charges to overseas visitors". [emphasis added][4]The equivalent immigration sanction provision in relation to leave to remain and variation of leave to enter or remain is in Rule 322(12).[5]In these judicial review proceedings, the claimants challenge the lawfulness of part of the Guidance. The complaint is directed at the way in which certain non-clinical information relating to non-resident patients ("the Information") is transmitted by the relevant NHS trusts and NHS foundation trusts (referred to collectively in this judgment as "the NHS bodies") to the Secretary of State who then passes it on to the Home Office (we shall refer to the latter department, rather than to its Secretary of State, to distinguish her from the Secretary of State for Health). The Information includes the name, date of birth and gender of the patient and (if known) his or her current address, the nationality and travel document number with expiry dates, as well as the amount and date of the debt and the NHS body to which it is owed.[6]The claimants are four non-UK residents who at the stage of the issue of this claim had been or were liable to be charged in excess of £1,000 each for NHS services, and were, therefore, liable to immigration sanctions if they failed to pay the charges due.[7]For the claimants David Wolfe QC and Nick Armstrong seek judicial review of the Guidance on the grounds that:(i) The Information is private and confidential;(ii) The NHS bodies have no power to transmit the Information to the Secretary of State who in turn has no power to transmit it the Home Office;(iii) Even if there is such a power at each stage, the Guidance is unlawful because it purports to require the NHS bodies to share the Information with the Secretary of State thus fettering their discretion to decide whether or not to do so; and(iv) Even if there is such a power at each stage, the transmitting of the Information is in breach of the claimants’ rights to respect for their private lives under article 8 of the European Convention on Human Rights (“the Convention”) because of the lack of the safeguards which article 8(2) requires.[8]Marie Demetriou QC and Sarah Abram, counsel for the Secretary of State, supported by Julie Anderson, counsel for the Home Office, contend that:(i) the Information is not private or confidential;(ii) the NHS bodies have not merely the power but the duty to transmit it to the Secretary of State; and the Secretary of State has the power to transmit it to the Home Office;(iii) since the NHS bodies are under a duty to transmit the Information to the Secretary of State, there is no discretion to fetter;(iv) there is no breach of the Claimants’ Article 8 rights.[9]Permission to pursue this claim was refused at first instance but granted on the papers in this court by Arden LJ, who remitted the case for a substantive hearing in the Administrative Court. This took place on 18 and 19 March 2014 before Silber J. By a reserved judgment dated 15 May 2014 he dismissed the claim. He held that:(i) the Information did not constitute confidential or private information because (a) it only identified the non-resident patient, the extent of the indebtedness and the NHS body to which the debt is owed, and (b) it did not refer to the patient's clinical history, why the patient sought medical treatment, the nature of the treatment received or anything about the patient's health;(ii) even if that were wrong and the Information was confidential or private, its transmission pursued a legitimate aim and was proportionate to the low level of harm caused by the limited disclosure involved;(iii) each of the NHS bodies had the statutory power to transmit the Information if it appeared “necessary or expedient for the purposes of or in connection with its functions" (section 47 of the National Health Services Act 2006 (“the 2006 Act”)). The transmission was necessary or expedient for the purposes of or in connection with the functions of the NHS bodies in the light of their obligations; and(iv) the Secretary of State had the power to transmit the information to the Home Office both under statute and at common law.[10]The British Medical Association (“BMA”) were concerned by the judge’s conclusion that the Information was not private and confidential, and applied to be joined to the proceedings on appeal. On 20 October 2014 Richards LJ granted the claimants permission to appeal (which the judge had refused) and also made an order permitting the BMA to intervene on the issue of privacy/confidentiality.

The duty to provide free health services and the right to charge

[11]The Secretary of State has a number of general duties in relation to the promotion and provision of the health service in England, described in section 1 of the 2006 Act, which together with other relevant statutory material is set out in the Appendix to this judgment. Section 1 includes duties on the part of the Secretary of State: "(1) [to] continue the promotion in England of a comprehensive health service ………; and "(2)… [to] exercise the functions conferred by this Act so as to secure that services are provided in accordance with this Act".[12]Section 1(4) of the 2006 Act provides that “the services provided as part of the health service in England must be free of charge except in so far as the making or recovery of charges is expressly provided for by or under any enactment, whenever passed". Section 2(1) provides that the Secretary of State may— “(a) provide such services as he considers appropriate for the purpose of discharging any duty imposed on him by this Act, and (b) do anything else which is calculated to facilitate, or is conducive or incidental to, the discharge of such a duty.”[13]Section 175 allows the Secretary of State to make regulations providing for the making and recovery of charges for services under the 2006 Act in respect of persons not ordinarily resident in Great Britain.

The Charging Regulations

[14]Regulation 3 of the Charging Regulations provides that relevant NHS bodies “must make and recover charges” [emphasis added] from overseas visitors, unless the Regulations exempt either the relevant service or the relevant patient from charges. There is no provision for means testing.[15]Exempted services include accident and emergency (“A&E”) services, whether provided at a hospital or elsewhere, although only up to the point of admission as an in-patient; family planning services; treatment for certain infectious diseases or for sexually transmitted infections; and the treatment of anyone detained under the Mental Health Acts. Likewise, certain categories of overseas visitor – in particular, refugees, asylum seekers, children in care and persons believed to be victims of human trafficking – cannot be charged for any hospital treatment.

The rationale for the charging regime for overseas visitors

[16]Mr. Craig Keenan, an official at the Department of Health, has explained in a witness statement that, by requiring NHS bodies to make and recover charges from overseas visitors for hospital services, the Secretary of State is safeguarding the NHS's limited resources, so as to be better able to fulfil his statutory duty to secure the provision of a comprehensive health service.[17]The evidence and submissions on behalf of the claimants make the valid point that not all patients liable to charges can be described as “health tourists”, that is to say people who come to the UK in order to obtain medical treatment. A visitor to the UK may be injured in an accident here and taken, perhaps unconscious, to an A&E department. Once transferred out of an A&E Department into a general ward, the visitor is liable to charges.[18]Mr Keenan’s evidence shows that the charging regime is effective only to a limited extent. He emphasises two particular problems. First, the NHS has difficulties in identifying accurately those overseas visitors who are not entitled to free hospital treatment. A review conducted by the Department of Health in October 2013 estimated that NHS trusts identify, on average, only 43% of all chargeable overseas patients. Secondly, most NHS Trusts struggle to recover charges even from those patients whom they identify as chargeable and invoice for their treatments. The 2013 study stated that it appeared that overall the NHS bodies collected “about 15% of the sums potentially chargeable to non-EEA patients (excluding irregular migrants)."

The Guidance

[19]At the same time as the Charging Regulations and Immigration Rules were amended, the Secretary of State revised the Guidance. The text of the Guidance (updated with amendments in October 2013) emphasises at paragraph 3.10 that the Charging Regulations do not confer any discretion on NHS bodies to waive charges. Appendix 7 is headed “Immigration Rules regarding debts for Chargeable NHS Hospital Treatment: Guidance on Administration and Data Sharing”. Appendix 7 of the 2013 edition included the following:(i) NHS bodies are "encouraged to support administration of [the new Rules] and thereby improve the recovery of their debts by providing relevant information to the Home Office" (para 2);(ii) NHS bodies should inform chargeable patients in advance that, if they do not pay charges for NHS treatment, then necessary (non-medical) personal information may be shared with the Home Office, via the Department of Health, and immigration sanctions may result (paras 3 to 7);(iii) Information should only be shared with the Home Office where the patient is not an EU citizen (or national of an EEA country or Switzerland) and does not have a right of residence because of their relationship with an EU citizen; the debt owed amounts to £1,000 or more; the debt has been outstanding for three months or more from the date of invoice; there are “no genuine outstanding challenges to, or doubt about, the legitimacy of the charge”; and “the patient was informed that information may be shared with other agencies for the purposes of the immigration sanctions” (para 8 with emphasis added);(iv) NHS bodies are not to exercise judgment or discretion regarding the other circumstances of individual cases (for example, domestic or compassionate circumstances, age and connections with the UK), because a discretion isexercised, solely by the Home Office, as to whether to apply immigration sanctions in individual cases (paras 10 and 23);(v) Para 12 states that "personal medical information relating to the treatment provided must not be included. Care should also be taken not to provide information from which the clinical history of the patient can be deduced";(vi) NHS bodies are reminded in para 13 of their duty to handle information in accordance with data protection law and the NHS Confidentiality Code of Practice;(vii) Para 13 ends with these words: “…it is not permissible to refuse urgent or necessary treatment in the event that information is withheld”.[20]The italicised passage in (iii) above was deleted in the 2014 edition of the Guidance, which states instead that “whilst it is not necessary to seek the patient’s consent before sharing their information with the Home Office, it is best practice – if possible and appropriate – to inform them that you have done so or are going to do so and why.” Any further references to the Guidance in this judgment will be to the 2014 edition.

How the data-sharing operates

[21]The process by which the NHS bodies share data on unpaid debts with the Secretary of State and the Home Office is described by Mr Keenan as follows:(i) the data transmitted by the NHS bodies is in spreadsheets sent by email by means of what he describes as a "Government Secure Internet account";(ii) the data supplied does not include any medical information but only information required to identify the individual and the sum that he or she owes;(iii) the data is collated centrally by the Department of Health, which in turn sends it on to the Home Office; and(iv) the Home Office uses the information in accordance with the Immigration Rules.[22]As we have said, the Information does not include any reference to the patient’s clinical history, medical condition, treatment or prognosis. But the identity of the NHS body making the charge is in some cases enough to indicate the nature of the patient’s illness, for example if it is an NHS Mental Health Trust, or (say) the Royal Marsden NHS Foundation Trust which specialises in cancer treatment.

The power to require NHS bodies to provide information

[23]Section 48 of the 2006 Act, on which Ms Demetriou placed much emphasis, provides in relation to NHS Foundation Trusts: “(1) The Secretary of State may require an NHS foundation trust to provide the Secretary of State with such information as the Secretary of State considers it necessary to have for the purposes of the functions of the Secretary of State in relation to the health service. (2) The information must be provided in such form, and at such time or within such period, as the Secretary of State may require.” (A similar provision applying to NHS Trusts is contained in paragraph 13 of Schedule 4 to the Act. Nothing turns for present purposes on the distinction between the two types of NHS body. We shall refer to “section 48” in this judgment without adding on each occasion “and para 13 of Schedule 4”).

The power to regulate the processing of patient information for medical purposes

[24]Section 251 of the Act, headed “control of patient information”, is set out in the Appendix. It enables the Secretary of State to make regulations in respect of regulating the processing of confidential patient information “for medical purposes”, the latter phrase being defined as including the purposes of the management of health and social care services.

The issues

[25]The principal issues are(i) does the Information include private and confidential information?(ii) If so, is its disclosure by NHS bodies to the Secretary of State and by the Secretary of State to the Home Office in breach of the claimants’ rights to privacy and confidentiality?(iii) Do the NHS bodies have the power to disclose the Information to the Secretary of State?(iv) Does the Secretary of State have the power to disclose it to the Home Office?(v) Does the disclosure infringe the claimants’ rights under article 8 of the Convention? IS THE DISCLOSURE OF THE INFORMATION IN BREACH OF THE CLAIMANTS’ COMMON LAW RIGHTS TO PRIVACY/CONFIDENTIALITY?[26]It is common ground that the test as to whether the disclosure of the Information to the Secretary of State and then to the Home Office breaches the claimants’ common law rights to privacy and confidentiality involves two questions. The first is whether the claimants have a reasonable expectation of privacy in relation to the Information. This question is judged objectively by reference to the reasonable person of ordinary sensibilities. If they do have a reasonable expectation of privacy, the second question is whether there has been a breach of their rights to privacy and confidentiality. This requires a balancing exercise of weighing the public benefit that would be attained by the transmission of the Information against the harm that would result from the interference with the rights.

Is the Information private and confidential?

[27]As we have already said, the judge concluded that the Information was not private or confidential. He reasoned as follows. The effect of the House of Lords decision in Campbell v MGN Ltd [2004] UKHL 22, [2004] 2 AC 457 is that, when deciding whether privacy rights are engaged, it is necessary to have regard to the reasonable expectations of the subject of the data in question. More precisely, following the judgment of Lord Hope, he said that the test is whether the matter would be “highly offensive and objectionable to a reasonable person of ordinary sensibilities” (para 42). He concluded that the Information is not private and confidential because(i) it “falls at the least intrusive end of the spectrum of medical information” since it contains no details of the illness, the medical history of the patient, the treatment or the prognosis (para 45); and(ii) this conclusion is reinforced by the fact that it is information which NHS bodies provide to debt collection agencies for the purpose of recovering debts owed by patients (para 46). In relation to the second reason, he said:
“It is difficult to see why debt collection agencies can be given details of the patient’s unpaid medical bills, while that at the same time it is somehow not permissible to transmit it securely to other organs of government whose employees are bound by strict rules of confidentiality and who received the information transmitted in confidence…”
[28]At paras 51 and 52, he added a third reason. Appendix 7 of the Guidance makes it clear that non-resident patients must be informed during the pre-treatment, treatment, invoicing and debt collection process that, if they fail to pay for NHS charges their non-medical information may be passed, via the Department of Health, to the Home Office: see paras 3 to 7. Para 6 of the Guidance states:
“For pre-attendance forms and invoices/undertaking to pay documents: ‘If you fail to pay for NHS treatment for which charges have been levied, it may result in a future immigration application to enter or remain in the UK being denied. Necessary (non-medical) personal information may be passed via the Department of Health to the Home Office for this purpose’.” ‘If you fail to pay for NHS treatment for which charges have been levied, it may result in a future immigration application to enter or remain in the UK being denied. Necessary (non-medical) personal information may be passed via the Department of Health to the Home Office for this purpose’.”
[29]The judge said that these provisions show that non-resident patients “have accepted, or at least appreciated, that onward transmission of the medical information was acceptable to him or her.”[30]As regards the judge’s first reason, Ms Proops and Mr Wolfe submit that he adopted the wrong approach to the question whether the Information is private and confidential. He relied heavily on the judgment of Lord Hope when formulating the test for determining whether information is to be treated as private. This includes the passage in which Lord Hope seems to support the view that the data subject must be “highly offended” by the particular conduct for privacy rights to be engaged. Silber J did not refer to the speech of Lord Nicholls, who said at para 21: “[e]ssentially the touchstone of private life is whether in respect of the disclosed facts the person in question had a reasonable expectation of privacy”.[31]But it is this passage that has been repeatedly adopted and applied by the courts: see, for example, McKennitt v Ash [2006] EWCA Civ 1714, [2008] QB 73 at para 11 and Murray v Express Newspapers [2008] EWCA Civ 446, [2009] Ch 481 at para 35. In R (Catt) v Association of Chief Police Officers [2015] UKSC 9, [2015] 2 WLR 664, Lord Sumption said at para 4 that in one sense Lord Nicholls’ test might be thought to be circular. But it must extend to “every occasion on which a person has a reasonable expectation that there will be no interference with the broader right of personal autonomy recognised in the case law of the Strasbourg court”. Yet more recently, in In the matter of an application by JR38 for Judicial Review (Northern Ireland) [2015] UKSC 42, the Supreme Court were somewhat divided about whether Lord Nicholls’ test was determinative and what it meant. Lord Kerr (Lord Wilson agreeing) said that it was not a test “to be treated as the be all and end all of whether article 8 is engaged” (para 55). Lord Toulson (Lord Hodge agreeing) said that the test of reasonable expectation of privacy must be applied “broadly taking account of all the circumstances of the case” (para 98). In our view, the differences between Lord Kerr and Lord Toulson are not material in the context of the present case. Lord Clarke summarised the position pithily at para 107:
“All the domestic cases support the proposition that, as Lord Nicholls put it, the touchstone of private life is whether the person in question had a reasonable expectation of privacy or, as Lord Sumption put it in Catt, the test for what constitutes private life is whether there was a reasonable expectation in the relevant respect.”
[32]As we understand it, Lord Clarke agreed with the approach of Lord Toulson Thus at para 114, he said: “the law is to be applied broadly, taking account of all the circumstances of the case”.[33]Lord Nicholls specifically deprecated the notion that the “highly offensive” formulation was relevant to the different question of whether the information was private. He said that this formulation was relevant to whether an interference with the right to privacy could be justified. At para 22, he said:
“Different forms of words, usually to much the same effect, have been suggested from time to time. The second Restatement of Torts in the United States (1977), article 652D, p 394, uses the formulation of disclosure of matter which 'would be highly offensive to a reasonable person'. In Australian Broadcasting Corporation v Lenah Game Meats Pty Ltd (2001) 185 ALR 1, 13, para 42, Gleeson CJ used words, widely quoted, having a similar meaning. This particular formulation should be used with care, for two reasons. First, the 'highly offensive' phrase is suggestive of a stricter test of private information than a reasonable expectation of privacy. Second, the 'highly offensive' formulation can all too easily bring into account, when deciding whether the disclosed information was private, considerations which go more properly to issues of proportionality; for instance, the degree of intrusion into private life, and the extent to which publication was a matter of proper public concern. This could be a recipe for confusion. ”
[34]We therefore accept the submission that, in so far as the judge regarded the “highly offensive” formulation as material to whether the Information was private and confidential, he was wrong to do so. Nor can we agree that the fact that the Information was “at the least intrusive end of the spectrum” indicates that it was not private. The fact that the disclosure may be “less intrusive” than disclosure of detailed information about an individual’s medical condition and treatment does not mean that it is not intrusive at all or that the information is not inherently private. Instead, it means that it is likely to be easier to justify disclosure. The conclusion that the Information was not private information at all would be correct only if it were, in privacy terms, entirely trivial which for the reasons that follow, it is not.[35]We accept the submission of Ms Proops that the Information is inherently private information, particularly because it reveals information of substance about the health of the data subjects, namely that they were unwell to the extent that they had to seek medical care at a particular point in time from one or more NHS bodies. In our view, subject to the effect of the Guidance (which we discuss at paras 43 to 46 below), we consider that there would be a reasonable expectation of privacy in respect of such information on the part of the patient. The fact that the data also includes charging information, which in itself reveals whether the treatment was relatively fleeting or extensive, only reinforces the conclusion that the Information is inherently private in nature. As we have said, the identity of the NHS body will in some cases be sufficient to indicate the nature of the patient’s illness. Indeed, given that the information tells you something of substance about an identified patient’s health, it must be treated as falling squarely within the definition of sensitive personal data as set out in section 2 of the Data Protection Act 1998 (“the DPA”).[36]Ms Demetriou submits that the Information is not about the details of the medical treatment in question. Rather, she says, it is about the details of the debt that the patient has incurred. She also points out that the person who incurs the debt will not always be the person who underwent the relevant medical treatment. All that one can tell from the Information is that the debtor(i) either had some medical treatment (of an unspecified nature and intensity) at the NHS body in question, or is the parent or employer of an overseas visitor who had such treatment;(ii) was charged for that treatment under the Charging Regulations; and(iii) has not paid the charge, or put in place any reasonable arrangement to effect payment, in at least 3 months.[37]We agree that the Information contains details of the debt. But it also contains confidential information for the reasons given by Ms Proops.[38]The claimants also point to various publicly available professional guidance documents and NHS documents which suggest that, in the medical context, sharing any information that is capable of identifying the patient is sharing confidential information and should be prohibited. For example, the General Medical Council’s Standards and Ethics Guidance for Doctors states that patients have a right to expect that information about them will be held in confidence by their doctors. There are various NHS documents to similar effect, including the NHS Code on Confidentiality and the NHS Care Record Guarantee. Also relevant is the BMA’s “Confidentiality and Disclosure of Health Information tool kit” which defines confidential information. It states at Card 2 that “all identifiable patient information … is subject to the duty of confidentiality”. This is expressed to cover not only clinical information but who the patient’s doctor is; what clinics the patient attends and when; and anything else that may be used to identify patients directly or indirectly, so that any of the information above, combined with the patient’s name or address or full postcode or date of birth, can identify them.[39]In our view, all of these documents articulate the same approach to the issue of confidentiality: all identifiable patient data held by a doctor or a hospital must be treated as confidential. The documents have been drafted in expansive terms so as to reflect the reasonable expectations of patients that all of their data will be treated as private and confidential. These publicly available documents inform the expectations of patients being treated in the NHS. They do not seek to distinguish between more or less sensitive categories of patient data.[40]The importance of the confidentiality attaching to information about a person’s health and treatment for ill-health has been repeatedly asserted in both common law and Strasbourg jurisprudence. As Lady Hale said at para 145 in Campbell: “It has always been accepted that information about a person's health and treatment for ill-health is both private and confidential. This stems not only from the confidentiality of the doctor-patient relationship but from the nature of the information itself. As the European Court of Human Rights put it in Z v Finland (1997) 25 EHRR 371, 405, para 95: "Respecting the confidentiality of health data is a vital principle in the legal systems of all the Contracting Parties to the Convention. It is crucial not only to respect the sense of privacy of a patient but also to preserve his or her confidence in the medical profession and in the health services in general. Without such protection, those in need of medical assistance may be deterred from revealing such information of a personal and intimate nature as may be necessary in order to receive appropriate treatment and, even, from seeking such assistance, thereby endangering their own health and, in the case of transmissible diseases, that of the community." "Respecting the confidentiality of health data is a vital principle in the legal systems of all the Contracting Parties to the Convention. It is crucial not only to respect the sense of privacy of a patient but also to preserve his or her confidence in the medical profession and in the health services in general. Without such protection, those in need of medical assistance may be deterred from revealing such information of a personal and intimate nature as may be necessary in order to receive appropriate treatment and, even, from seeking such assistance, thereby endangering their own health and, in the case of transmissible diseases, that of the community."[41]We do not agree with the judge that the fact that the Information (or some of it) may be provided by NHS bodies to debt collection agencies sheds any light on whether the Information is private and confidential. The fact that certain private information about an individual’s treatment may be provided by NHS bodies to debt collection agencies, presumably on a confidential basis, does not mean the information loses its quality of being private or that it was never private in the first place. The fact that the Information is shared with a debt collection agency may well be relevant to the separate question of whether disclosure of the Information to the Secretary of State and the Home Office is justified.[42]Mr Wolfe distinguishes debt collectors (and solicitors who are instructed to recover debts) from the Secretary of State or the Home Office on the grounds that the former group are agents for the relevant NHS body rather than independent of it. But the distinction, with respect, is formalistic. The duty of confidence originates as a professional duty of the treating doctors, nurses and ancillary staff. Plainly they are entitled, without being in breach of that duty, to pass the Information to hospital administrators for the purpose of record keeping and of recovery of the charges. Irrespective of the immigration sanctions regime, the existence of these debts can lead to a county court claim, a public hearing and an entry in the register of county court judgments. We do not see that passing the Information to the Secretary of State is different in kind.[43]We must, however, now deal with the judge’s third reason for holding that there isno reasonable expectation of privacy in the Information: see paras 28 and 29 above. Prior to August 2014, Appendix 7 to the Guidance stated that the Information could not be shared unless the patient had been informed. As we have seen, the updated version does not include a prohibition in such absolute terms. But para 9 of this version makes it clear that “[w]hilst it is not necessary to seek the patient’s consent before sharing their personal information with the Home Office, it is best practice—if possible or appropriate—to inform [the patient] that you have done so or are going to do so and why”. We do not consider that the fact that informing the patient is now only described as “best practice” is material. A patient liable to charges will reasonably expect that, in the event of default, steps will be taken to enforce payment, which may include informing others of the fact, duration and cost of his stay at the hospital concerned; and that to this extent their stay at the hospital will not necessarily be kept confidential.[44]Ms Proops submits that the fact that patients are made aware that the information may be transmitted to the Home Office does not of itself mean that the data are not private or confidential. We disagree. The Supreme Court decision in JR 38 confirms what was said in cases such as Murray that the question whether there is a reasonable expectation of privacy is a broad one which takes account of all the circumstances of the case. We do not see how overseas visitors who, before they are treated in an NHS hospital, are made aware of the fact that, if they incur charges in excess of £1,000 and do not pay them within 3 months, the Information may be passed to the Secretary of State for onward transmission to the Home Office for the stated immigration purpose can have any, still less any reasonable, expectation that the Information will not be transmitted in precisely that way. They will, however, have a reasonable expectation of privacy in relation to the Information vis-à- vis anyone else.[45]We therefore consider that the judge was right to hold that the Information is generally not private information vis-à-vis the Secretary of State and the Home Office. There may, however, be special circumstances where the position will be different. For example, the patient may have been admitted unconscious to the A&E Department of a hospital (for which no charges are made) and have been transferred, still unconscious, to a hospital ward (where treatment does attract charges). There may also be emergency cases where the clinical staff cannot refuse treatment and where, in practice, the patient has no choice but to accept the terms on which it is offered. Furthermore, in some cases the patient may be vulnerable and/or unable to speak English. But in most cases where the best practice set out in Appendix 7 of the Guidance is followed, the patient will not have a reasonable expectation of privacy in the Information so far as the Secretary of State and the Home Office are concerned.[46]None of this should be a cause for concern to the BMA or any other medical authority. The present case is concerned with a particular regime under which patients are usually informed that the limited details contained in the Information may be disclosed to a limited class of persons for a particular reason connected with immigration control. It should not be seen as a Trojan horse which will lead to the dismantling of the principle that information about a person’s health and medical treatment is inherently private and confidential.[47]We do not know whether all or any of the claimants were notified in accordance with the Guidance that the Information would be disclosed to the Secretary of State and the Home Office, or whether there were any special circumstances which made such notification impracticable in their case.

The balancing exercise

[48]But the common law right to privacy and confidentiality is not absolute. English common law recognises the need for a balancing between this right and other competing rights and interests: see per Lord Goff in Attorney General v Guardian Newspapers Limited (No 2) [1990] 1 AC 109 at p 282 E-F and per Lord Hope in Campbell at para 106. Lord Goff said:
“…although the basis of the law’s protection of confidence is that there is a public interest that confidence should be preserved and protected by the law, nevertheless, that public interest may be outweighed by some other countervailing public interest which favours disclosure.”
[49]The exercise required by the common law is broadly analogous to that required by article 8(2) of the Convention. It is, therefore, necessary to consider in the words of Lord Hope in Campbell at para 113:
“whether publication of the material pursues a legitimate aim and whether the benefits that will be achieved by its publication are proportionate to the harm that may be done by the interference with the right to privacy.”
[50]In concluding that the balance came down in favour of disclosure of the Information, Silber J relied on the fact that(i) the intrusion is at the lower end of the spectrum;(ii) overseas patients are advised of the right of the hospital to pass on the Information;(iii) the disclosure pursues the legitimate aim of improving the recovery of NHS debts and ensuring that those who default in paying their debts are not entitled to remain in the UK; and(iv) the Information is securely transmitted to a limited group of civil servants in the Department of Health and the Home Office.[51]Mr Wolfe does not submit that this balancing exercise is flawed. It clearly is not. It follows that, even if the claimants had a right to privacy and confidentiality in the Information, it was not infringed by the disclosure.

THE VIRES ISSUES

[52]Mr Wolfe submits that the NHS bodies do not have the power to transmit the Information to the Secretary of State and the Secretary of State does not have the power to transmit the Information to the Home Office for the following reasons. First, the transmissions infringe the claimants’ fundamental rights of privacy and confidentiality. The effect of the common law principle of legality is that such an infringement can only be sanctioned by clear specific statutory language. There is no such language. Secondly and in any event, there is no statutory authority for either transmission of the Information. Thirdly, the Secretary of State has no common law power to transmit the Information to the Home Office. It is common ground that the source of the power of the NHS bodies can only be statutory.

The legality principle

[53]Mr Wolfe submits that the principle of legality requires that the infringement of a fundamental right (such as the right to privacy) be authorised by Parliament expressly or by necessary implication. Such a right cannot be overridden by general words. Since there is no specific Parliamentary authorisation for the transmission of private and confidential information by NHS bodies to the Secretary of State and the Secretary of State to the Home Office, they have no power to transmit the Information.[54]In support of his argument, Mr Wolfe relies on well known cases such as R v SSHD, ex p Simms [2000] 2 AC 115 and R (Daly) v SSHD [2001] UKHL 26, [2001] 2 AC 532. The principle that fundamental rights cannot be overridden or infringed without clear Parliamentary authority is not in doubt. Thus, in Simms it was held that, in the absence of express language or necessary implication to the contrary, it was to be presumed that Parliament did not intend to authorise the imposition by the Prison Rules of an indiscriminate ban on all interviews by journalists with prisoners such as would infringe their right to seek access to justice. In Daly, Lord Bingham said at para 5 that prisoners’ rights of access to a court, access to legal advice and to communicate confidentially with a legal adviser may “be curtailed only by clear and express words, and then only to the extent reasonably necessary to meet the ends which justify the curtailment”. The rationale for the principle of legality is, as Lord Hoffmann said in Simms at p 131F, that Parliament must “squarely confront what it is doing and accept the political cost”.[55]The transmission of the Information infringes a patient’s right to privacy only if(i) he or she has a reasonable expectation of privacy in the Information and(ii) the balancing exercise comes down against disclosure. A breach of the fundamental privacy right will not be established unless both (i) and (ii) are satisfied. In our judgment, the principle has no application in the present context. It only applies where the question is whether there is statutory authority for the infringement or breach of a fundamental right. But for the reasons that we have already given, disclosure of the Information does not infringe the claimants’ privacy rights. As Ms Demetriou puts it, there is no breach which, to use the words of Lord Hoffmann, Parliament must “squarely confront”. In our view, this is the decisive answer to the argument based on the legality principle. Do the NHS bodies have the power to pass on the Information to the Secretary of State?[56]Mr Wolfe submits that the existence of the power conferred on the Secretary of State by section 251 of the 2006 Act by regulations to “make such provision for and in connection with requiring or regulating the processing of prescribed patient information for medical purposes as he considers necessary or expedient” precludes reliance on general statutory powers to require NHS bodies to transmit the Information. The section 251 power has been exercised to a limited extent in the Health Service (Control of Patient Information) Regulations 2002, but these have nothing to do with charges. It has not been exercised to make regulations in relation to patient information. Mr Wolfe submits that the existence of the specific power conferred by section 251 is fatal to Ms Demetriou’s argument that the power in NHS bodies to disclose confidential patient information derives from section 48 (being required to do so by the Secretary of State); alternatively, from section 47 (doing anything which appears to be necessary or expedient).[57]We accept the correctness of the statement of Lord Bingham CJ in R v Liverpool CC, ex p Baby Products Association [2000] LGR 171 at p 178 that:
“[a] power conferred in very general terms plainly cannot be relied on to defeat the intention of clear and particular statutory provisions”
. The reason is that, if Parliament has enacted specific provisions to govern a particular subject-matter, then it is to be taken to have intended that the same subject-matter will not be governed by other more general provisions. Section 47 is undoubtedly expressed in very general terms. Section 48 confers a specific power in the Secretary of State to require NHS bodies to provide information to him and, by implication, a corresponding obligation on the NHS bodies to provide it. The question is whether the existence of the detailed provisions in section 251 in relation to the control of “patient information” leave no room for interpreting section 48 as extending to the provision of information that a patient has received unspecified medical treatment from a particular NHS body.[58]The judge held that the transmission of medical information for the purposes of the immigration sanctions does not fall within the ambit of section 251 because (i) the information is not within the definition of “patient information” in section 251(10)(a) and (ii) the transmission of the material to the Secretary of State is not for “medical purposes” as defined in section 251(12).[59]Mr Wolfe submits that the judge was wrong on both counts. Ms Demetriou advanced a number of arguments in support of the judge’s conclusion, but she also submitted that even if the information was patient information as defined, nonetheless nothing in section 251 displaced the power of the Secretary of State under section 48 simply to require the provision of the relevant information, rather than having to make regulations about it.[60]We do not accept Mr Wolfe’s submission that the particularity of Section 251 precludes the Secretary of State from relying upon section 48 as providing the vires for the requirement that the Information is made available to him by NHS bodies. Section 48 confers a clear explicit power upon the Secretary of State to require the disclosure of the relevant information unless only that general power is cut down by the specificity of the power to make regulations in section 251. But section 251 is not simply or even mainly about the Secretary of State’s power to require the provision of information. Rather it confers a power to make regulations about what others may or must do by way of the processing of patient information (as widely defined), including confidential patient information. It is a rule making power about how information is to be processed rather than simply a power enabling him to demand the disclosure of particular information to himself.[61]Unlike the judge, we are prepared to assume that information of the type in issue in this case is patient information as defined in section 251(10) and that provision of it to the Secretary of State in accordance with the Guidance will be for medical purposes, as defined. We also accept that the provision of it will amount to a defined form of processing of it, namely disclosure. But it by no means follows that section 251 excludes the section 48 power simply to require the provision of such information, without first making specific regulations for that purpose. To interpret section 251 as having been intended to require that preliminary step seems to us to involve an unreal element of pure formalism. There will be all sorts of circumstances, large and small, urgent and non-urgent, when the Secretary of State needs to exercise the section 48 power to require the disclosure of information by NHS bodies which are separate legal persons, but where it would be an unnecessary encumbrance upon him first to enable himself to do so by making regulations for that purpose.[62]Put another way, section 48 is in a real sense more specific than section 251, in relation to patient information. Section 48 merely provides power for the Secretary of State to require that it (or a specified part of it) be given directly to him, whereas the power in section 251 is broad enough to enable the Secretary of State to regulate every aspect of the processing of such information, whether or not it involves its dissemination beyond the walls of an NHS body, and regardless of the classes of persons to whom it might be communicated: see the very wide definition of ‘processing’ in section 251(13).[63]The result is, in our view, that neither section 251 nor section 48 confer powers in a manner which excludes the other section, as the source of the power to do exactly what each section expressly authorises. We recognise that there may be situations where a particular objective might be achieved by the use of either power, and this case may indeed be one of them. But the general thrust of the two sections is distinct, in the way which we have described, and the Secretary of State therefore had power under section 48 simply to require the provision of the Information to himself without making regulations under section 251 for that purpose, provided that the requirements of section 48 were satisfied in relation to the information requested.[64]Ms Demetriou submits that, by publishing the Guidance, the Secretary of State has exercised his power under section 48 to require the NHS bodies to provide the Information. It is necessary to refer to several passages in the Guidance. Para 2 states that NHS bodies are “strongly encouraged to support the administration of these rules and thereby improve the recovery of their debts by providing the relevant information to the Home Office”. Para 12 states that the Home Office “require as many pieces of information as can reasonably be provided in order to verify the unique identity of the person who has incurred the debt”. Para 16 states that NHS bodies “should collate the relevant information and pass it securely to the Overseas Visitor Team at the DH”. Para 17 states that the information “should be sent in response to the DH team’s request for it”. Para 25 sets out the “roles and responsibilities” of the NHS bodies. These are detailed and mandatory in form. We accept the submission of Ms Demetriou that in substance the Guidance sets out the information that the Secretary of State requires the NHS bodies to provide.[65]The next question is whether the provision of this information is considered by the Secretary of State to be necessary for the purposes of his functions under the 2006 Act in relation to the health service. Mr Wolfe submits that the making and recovery of charges in respect of overseas patients is a function of the NHS bodies, not of the Secretary of State.[66]Mr Wolfe is correct to say that, while the Secretary of State’s functions include (under section 175) issuing regulations for the making and recovery of charges, the Charging Regulations provide that these functions are to be carried out by the NHS bodies. However, the functions of the Secretary of State on which Ms Demetriou relies are the more general ones set out in section 1 of the 2006 Act. Thus he has the duty under section 1(1) “to continue the promotion in England of a comprehensive health service designed to secure improvement(a) in the physical and mental health of the people of England, and(b) in the prevention, diagnosis and treatment of illness”. For that purpose he is required by section 1(2) “to provide or secure the provision of services in accordance with this Act”. His functions under the 2006 Act include (by virtue of section 48) that of requiring NHS bodies to provide information. Ms Demetriou submits that the requirement to provide the Information is designed to help secure the provision of health services by facilitating the recovery of charges, which in turn contributes to the finances of the NHS. We accept this submission.[67]We conclude, therefore, that the Secretary of State has the power under section 48 to require the NHS bodies to transmit the Information to him. It follows that the NHS bodies have the statutory duty (and therefore also the power) to comply with the requirement. It is therefore unnecessary to consider whether the NHS bodies also have the power to transmit the Information to the Secretary of State under section 47. Does the Secretary of State have the power to pass the Information to the Home Office?[68]Section 2 of the Act permits the Secretary of State to do anything which is calculated to facilitate or is conducive or incidental to the discharge of any duty imposed on him by the Act. If, as we have held, the Secretary of State can lawfully require the NHS bodies to provide the Information to him in order to help the promotion of a comprehensive health service and to secure the provision of services by facilitating the recovery of charges, we consider that he can by the same token lawfully pass the Information on to the Home Office on the basis that it is calculated to facilitate the discharge of the same statutory duty.[69]Alternatively, irrespective of Section 2, we consider that passing on the Information to the Home Office is permitted at common law. In R (Shrewsbury and Atcham BC)v Secretary of State for Communities and Local Government [2008] 3 All ER 548 Carnwath LJ expressed the view that the residual category of ministerial power not dependent on either statute or prerogative should be confined to the exercise of powers for identifiably governmental purposes. Richards LJ took a wider view.[70]It is unnecessary to decide between the two views in this case since even on Carnwath LJ’s formulation we consider that the Secretary of State was entitled to pass on the information to the Home Office. Both the Charging Regulations and the Immigration Rules give effect to Government policy, as it happens covering the responsibilities of two Departments. The historic doctrine was that the Secretary of State was one person. In the twenty-first century the passing of information from one Department to another for identifiably governmental purposes can more realistically be described as joined-up government.

The fettering of discretion argument

[71]The claimants submit that insofar as the Guidance deprives the NHS bodies of any discretion to withhold the Information from the Secretary of State, it is unlawful. The Guidance provides that the duty to pass on the Information does not arise in certain cases, for example if it is questionable whether the charge applies, but there is no discretion not to pass on the Information on the grounds of inability to pay or of possible deterrence to an individual patient from seeking treatment.[72]The evidence of Mr Hundt on behalf of the claimants shows (and we think it is obvious) that hard cases will arise in which someone who needs treatment but has no means of paying for it will be deterred from obtaining it, even though there are exemptions for vulnerable categories such as asylum seekers, victims of trafficking and a general exemption for A&E services.[73]But the short answer to the argument that the Guidance unlawfully fetters the discretion enjoyed by NHS bodies to decide whether or not to impart the Information in particular cases is that they have no such discretion. They are required by section 48 to provide information in accordance with the Guidance. We therefore reject the “fetter on discretion” argument.

ARTICLE 8 OF THE CONVENTION

[74]Mr Wolfe submits that the transmission of the Information by the NHS bodies to the Secretary of State and the further transmission of it to the Home Office are in breach of the claimants’ rights to respect for their private lives under article 8 of the Convention. The two issues that arise are(i) whether article 8 is engaged at all, and(ii) if so whether any interference with the appellants’ article 8 rights is “in accordance with the law”. It is common ground that, if article 8 is engaged and any interference is “in accordance with the law”, then the interference is justified as being “necessary in a democratic society” (article 8(2)).

Is article 8 engaged?

[75]Ms Demetriou submits that article 8 is not engaged because the Information is debt information and is not private and confidential. For the reasons that we have explained earlier, whether the Information is confidential at common law will depend on the facts of the particular case. We do not, however, need to decide whether article 8 is engaged in those cases where the Information is not private and confidential, because any interference with article 8 rights would be justified under article 8(2). The only issue arising under article 8(2) is whether the interference would be “in accordance with the law”. It is to that issue that we now turn.

In accordance with the law

[76]It is now clear from MM v UK (Appln No 24019/07) that the requirement that any interference with a Convention right must be “in accordance with the law” means that: “the impugned measure must have some basis in domestic law and be compatible with the rule of law, which is expressly mentioned in the preamble to the Convention and inherent in the object and purpose of Article 8. The law must thus be adequately accessible and foreseeable, that is, formulated with sufficient precision to enable the individual—if need be with appropriate advice—to regulate his conduct. For domestic law to meet these requirements, it must afford adequate legal protection against arbitrariness and accordingly indicate with sufficient clarity the scope of discretion conferred on the competent authorities and the manner of its exercise” (para 193).[77]The same approach has been adopted by the Supreme Court in R (T) v SSHD [2014] UKSC 35, [2015] AC 49, R (Catt) v ACPO [2015] UCKSC 9, [2015] 2 WLR 664 and Beghal v DPP [2015] UKSC 49, [2015] 3 WLR 344. As Lord Sumption said in Catt at para 11, the purpose of the “in accordance with the law” requirement is “not limited to requiring an ascertainable legal basis for the interference as a matter of domestic law. It also ensures that the law is not so wide or indefinite as to permit interference with the right on an arbitrary or abusive basis”. Its purpose is also to enable the court to declare unlawful “an over-rigid regime which does not contain the flexibility which is needed to avoid an unjustified interference with a fundamental right”: Beghal at para 31 per Lord Hughes.[78]Mr Wolfe submits that the law in question must(i) have all the quality of law and be clear and binding;(ii) be sufficiently clear, precise, foreseeable and have safeguards set out in statute (including as regards the circumstances in which data can be collected, retained and destroyed); and(iii) as part of the safeguards against arbitrariness, have a discretion that avoids unnecessary or disproportionate data-sharing in individual cases. He contends that our domestic law fails to meet any of these requirements. First, data-sharing is effected by no more than “best practice guidance” and it has no foundation in law save, at best, very general powers. Secondly, and in consequence, there are no safeguards in place and certainly no precise or foreseeable ones. There is no limit on the number of people who can see the data and there is no mechanism for ensuring that only necessary data is transmitted. Thirdly, there is no discretion not to share data. The existence of such discretion is the most important safeguard of all. There are likely to be circumstances in which a data-share would be disproportionate, for example where children or migrants in need of urgent medical attention are involved. And yet there is no provision for dispensing with the requirement to transmit the Information in particular circumstances.[79]In our view, it is clear that the data are shared by the NHS bodies with the Secretary of State pursuant to the procedures and principles stated in the Guidance. The fact that the Guidance is non-statutory is not objectionable. As Lord Sumption said in Catt at para 11:
“the rules need not be statutory, provided that they operate within a framework of law and that there are effective means of enforcing them. Their application, including the manner in which any discretion will be exercised, should be reasonably predictable, if necessary with the assistance of expert advice. But except perhaps in the simplest cases, this does not mean that the law had to codify the answers to every possible issue which may arise. It is enough that it lays down principles which are capable of being predictably applied to any situation.”
[80]It is relevant that the Guidance makes clear that data-sharing is subject to the requirements of the DPA. Thus para 2 states that “[p]rovision of this [NHS debt] information must take full account of data protection”; and para 18 states that “[t]he DH will collate individual returns and pass them securely to the Home Office. The holding and/or transfer of all personal data must comply with the requirements of the Data Protection Act 1998”.[81]The DPA provides a number of safeguards for individuals in relation to the processing of personal data, including the following. First, individuals are entitled to have access to their personal data (section 7). Secondly, data controllers (those who determine how and for what purposes data are to be processed) are subject to a legal obligation to comply with data protection principles (section 4(4)). These are set out in Schedule 1. They include that personal data must be processed in accordance with the rights of data subjects under the DPA (principle 6) and that proper and proportionate measures must be taken against the unauthorised or unlawful processing of the data (principle 7). Thirdly, individuals are entitled to compensation for damage or distress caused by a data controller’s contravention of any of the requirements of the DPA (section 13). Fourthly, if a person considers that their data have been processed in contravention of the DPA, they may request an assessment by the Information Commissioner (section 42) who can impose a number of remedies including an enforcement notice requiring compliance with the data protection principles (section 40).[82]The Guidance contains its own specific limits on the extent to which data may be shared and the conditions for such sharing. Para 8 identifies the criteria for referring cases of outstanding debt to the Home Office. Para 11 states:
“NHS staff should not exercise judgment or discretion regarding other circumstances of individual cases (for example domestic or compassionate circumstances, age, connections with the UK). For these and other circumstances the immigration rules provide for discretion in applying the sanctions in exceptional circumstances, but this is a matter solely for Home Office staff at the time and point of their engagement. The NHS should therefore continue to refer information relating to such cases.”
[83]Para 12 identifies the details of the information required by the Home Office, i.e. the Information.[84]Mr Wolfe places particular emphasis on the argument that there is no discretion in the NHS bodies not to share the data with the Secretary of State or in the Secretary of State not to share the data with the Home Office. He relies on the decisions in MM and T in support of his submission that this feature of the case alone compels the conclusion that it is not in accordance with the law. We disagree.[85]In both of those cases, the legislation in question required the disclosure of all criminal convictions and cautions, even if spent and regardless of the seriousness of the offence, to a prospective new employer. The information (which was highly sensitive) had to be disclosed even if consideration of an individual case would have led to the conclusion that the particular conviction or caution could not be relevant to the employment sought. In the present case, the information is tightly circumscribed and is only shared for the purpose of enabling the NHS charging policy to be effective. We accept that in some cases the identity of the hospital will disclose the nature of the treatment in respect of which the debt was incurred (for example mental illness in a mental hospital or cancer in a specialist cancer hospital or clinic) and that this may be regarded as particularly sensitive confidential information. But in most cases, the disclosure will be of material which is low on the spectrum of confidential information. In any event, the protections afforded by the Guidance and the DPA are such that we do not consider that the lack of discretion in the NHS bodies and the Secretary of State renders the entire scheme open to abuse or arbitrary decision-making. An important point to note is that immigration officers have a discretion to decide whether or not to grant leave to enter and leave to remain in the United Kingdom.[86]The comparison with Catt is striking. It was the practice of the police to identify participants in demonstrations and to keep information about them on a “domestic extremism” database maintained by the National Public Order Intelligence Unit. The database had no statutory foundation, but was subject to the DPA and administrative codes of conduct issued under the Police Act 1996. At para 12, Lord Sumption said that the DPA is a statute of general application. It lays down “principles which are germane and directly applicable to police information and contains a framework for their enforcement on the police among others through the Information Commissioner and the courts”. The data protection principles constitute “a comprehensive code”. He said that the combination of the requirements of the DPA, the Code of Practice and the detailed Guidance issued by the Association of Chief Police Officers provided sufficient protection against arbitrary police behaviour, so that the collection and retention of the information was “in accordance with the law”.[87]So too here. Disclosure of the Information is subject to the Guidance and the DPA. They provide sufficient protection against arbitrary or abusive disclosure. The process is subject to review by the Information Commissioner and the courts pursuant to the DPA. In all the circumstances, we are satisfied that the modest interference with the claimants’ article 8 rights entailed by disclosure of the Information for the purpose for which it is required is “in accordance with the law”.

OVERALL CONCLUSION

[88]For the reasons set out above, we dismiss this appeal.

Cited in 8 later judgments