Anthony Dixon v North Bristol NHS Trust [2022] EWHC 3127 (KB)

[2022] EWHC 3127 (KB)

Case No QB-2022-002007

IN THE HIGH COURT OF JUSTICE

KING’S BENCH DIVISION

MEDIA & COMMUNICATIONS LIST

Venue Royal Courts of Justice, Strand, London, WC2A 2LL

Date 7 December 2022

Before

THE HONOURABLE MR JUSTICE NICKLIN

Between

Anthony DixonClaimant

North Bristol NHS TrustDefendant

Simon Cheetham KC and Nicola Newbegin (instructed by Clyde & Co LLP)

for Claimant

Jeremy Hyam KC (instructed by DAC Beachcroft LLP) for Defendant

Hearing Hearing date: 20 September 2022

Approved Judgment

This judgment was handed down by the Judge remotely by circulation to the parties and their representatives by email and by release to The National Archives. The date and time for hand-down is deemed to be 2pm on 7 December 2022.

[1]This is the second judgment in this claim. It deals with the Claimant’s application for an interim injunction to restrain the Defendant from providing two documents to a limited category of persons.

A: Parties and background

[2]The parties, the background to the litigation and the nature of the Claimant’s claim are set out in the judgment I handed down (in private, on 19 July 2022 and in public on 26 July 2022) in which I refused the Claimant’s application to be anonymised in the proceedings (

[2022] EWHC 1871 (QB)

) (“the First Judgment”). I shall use the same definitions in this judgment. The Claimant did not appeal that decision, so that judgment identifies the parties.

[3]The Order, dismissing the anonymity application, made directions requiring the Claimant to file and serve his finalised Particulars of Claim by 22 July 2022; the Defendant to file and serve an Acknowledgement of Service and any Defence by 5 August 2022; and for the Claimant to issue, file and serve any Application Notice and evidence in support seeking an interim injunction by 12 August 2022. The hearing of the interim injunction was fixed for 20 September 2022. The Defendant gave an undertaking that it would not disclose the material the subject of the interim injunction application until the Court had heard and determined the application.

B: The proposed disclosure by the Defendant

[4]Some of the pre-action correspondence, in which the Defendant notified the Claimant of its intention to disclose certain documents, is set out in the First Judgment: [12]-[14]. On 13 June 2022, the Defendant’s solicitors sent a detailed letter to the Claimant’s solicitors explaining the Defendant’s position as follows (“the Proposed Disclosure”):

“It is the Trust’s intention to disclose both [Document X] and the MHPS outcome letter to the Solicitors for all Claimants bringing claims against the Trust in respect of care provided by Mr Dixon. The Trust remains of the view that both documents are disclosable in clinical negligence claims against the Trust, pursuant to CPR 31.6 following the commencement of a claim, and pursuant to CPR 31.16 in relation to claims in the pre-action protocol stage.”

[5]The extent of the Proposed Disclosure, as defined in that letter, was to the solicitors to the relevant claimants. A point made by Mr Cheetham KC on behalf of the Claimant is that such disclosure is effectively also disclosure to the claimants themselves. Certainly, absent some unusual restriction being placed on the solicitors to prevent disclosure of the documents to their respective clients, Mr Cheetham must be correct. I will therefore treat the Proposed Disclosure as including disclosure to the claimants themselves.

C: The Claim

[6]The Claimant alleges that the Proposed Disclosure would be(a) a breach of contract;

(b) a breach of confidence and/or misuse of private information; and

(c) a breach of the Claimant’s data protection rights under the General Data Protection Regulation (“GDPR”) and Data Protection Act 2018. In his Particulars of Claim (which includes a Confidential Schedule), he contends that the Proposed Disclosure would be unlawful, in summary amounting to: i) a breach of the express and implied terms of his contract of employment with the Defendant and/or a contract entered into in respect of the investigation under MHPS and generally; ii) a breach of confidence, being an unauthorised use of the information contained in the MHPS outcome letter and Document X outside the purpose for which the information was collected; iii) a misuse of private information, being an unjustified intrusion into the Claimant’s privacy in circumstances where the disclosure would be to individuals and their representatives who were not the subject of any investigation; and iv) a breach of the Data Protection Act 2018 and/or the General Data Protection Regulation (as modified under English law) (“GDPR”).

[7]The Particulars of Claim also contain a free-standing claim that the Proposed Disclosure would be a breach of the Claimant’s Article 8 rights. This claim has not been pursued in support of the injunction application, but it is under this claim that the Claimant has identified the particular harm or detriment that would be caused to him by the Proposed Disclosure as damage to his Article 8 rights; the right to practise and have access to his profession, the right to protect his professional reputation, and the protection of his correspondence. More generally as to damage, in his Particulars of Claim, the Claimant alleges that the Proposed Disclosure:

“… would cause serious damage, including irrecoverable reputational damage, as well as significant mental and physical distress to the Claimant, and his family, in particular to the Claimant’s wife and the Claimant’s elderly mother. It is also likely to damage the Claimant’s mental and physical health.”

[8]In terms of remedies, the Claimant seeks: i) a declaration that(a) the MHPS outcome letter and Document X are “confidential in nature”; and

(b) the Proposed Disclosure is unlawful; ii) an injunction to restrain the Defendant from undertaking the Proposed Disclosure unless required or expressly permitted to do so by order of the Court; and iii) an order pursuant to s.167 Data Protection Act 2018 (compliance order) and/or Article 79 GDPR (right to effective judicial remedy).

[9]It is necessary to look at each of the causes of action relied upon by the Claimant in a little more detail. Before doing so, it is important to note what the CPR requires to be set out in the Particulars of Claim in respect of claims for breach of confidence and/or misuse of private information and/or data protection claims. CPR PD 53B provides: “Misuse of private or confidential information8.1 In a claim for misuse of private information, the claimant must specify in the particulars of claim (in a confidential schedule if necessary to preserve privacy)—

(1) the information as to which the claimant claims to have (or to have had) a reasonable expectation of privacy;

(2) the facts and matters upon which the claimant relies in support of the contention that they had (or have) such a reasonable expectation;

(3) the use (or threatened use) of the information by the defendant which the claimant claims was (or would be) a misuse; and

(4) any facts and matters upon which the claimant relies in support of their contention that their rights not to have the specified information used by the defendant in the way alleged outweighed (or outweigh) any rights of the defendant to use the information in that manner.

8.2 In a claim for misuse of confidential information or breach of confidence, the claimant must specify in the particulars of claim (in a confidential schedule if necessary to preserve confidentiality) — (1) the information said to be confidential; (2) the facts and matters upon which the claimant relies in support of the contention that it was (or is) confidential information that the defendant held (or holds) under a duty or obligation of confidence; (3) the use (or threatened use) of the information by the defendant which the claimant claims was (or would be) a misuse of the information or breach of that obligation. Data Protection 9. In any claim for breach of any data protection legislation the claimant must specify in the particulars of claim— (1) the legislation and the provision that the claimant alleges the defendant has breached; (2) any specific data or acts of processing to which the claim relates; (3) the specific acts or omissions said to amount to such a breach, and the claimant’s grounds for that allegation; and (4) the remedies which the claimant seeks. (1) the information as to which the claimant claims to have (or to have had) a reasonable expectation of privacy; (2) the facts and matters upon which the claimant relies in support of the contention that they had (or have) such a reasonable expectation; (3) the use (or threatened use) of the information by the defendant which the claimant claims was (or would be) a misuse; and (4) any facts and matters upon which the claimant relies in support of their contention that their rights not to have the specified information used by the defendant in the way alleged outweighed (or outweigh) any rights of the defendant to use the information in that manner. (2) the facts and matters upon which the claimant relies in support of the contention that it was (or is) confidential information that the defendant held (or holds) under a duty or obligation of confidence; (3) the use (or threatened use) of the information by the defendant which the claimant claims was (or would be) a misuse of the information or breach of that obligation. Data Protection (1) the legislation and the provision that the claimant alleges the defendant has breached; (2) any specific data or acts of processing to which the claim relates; (3) the specific acts or omissions said to amount to such a breach, and the claimant’s grounds for that allegation; and (4) the remedies which the claimant seeks. (1). Breach of contract/Breach of confidence

[10]The Claimant contends that there are express and/or implied terms as to confidentiality in both his employment contract and under the Maintaining High Professional Standards (“MHPS”) investigation process. Further, or alternatively, the Claimant contends that the circumstances are such that the Defendant is under an equitable duty of confidence and that the Proposed Disclosure would breach this duty.

[11]MHPS contains express terms relating to confidentiality, which the Claimant contends have been incorporated into his employment contract with the Defendant: i) Part 1, Paragraph 23 provides:

“Employers must maintain confidentiality at all times. No press notice should be issued, nor the name of the practitioner released, in regard to any investigation or hearing into disciplinary matters. The Employer should only confirm that an investigation or disciplinary hearing is underway.” ii) Part 4, Paragraph 46 provides: “Records must be kept, including a report detailing the capability issues, the practitioner’s defence or mitigation, the action taken and the reasons for it. These records must be kept confidential and retained in accordance with the capability procedure and the Data Protection Act 1998. These records need to be made available to those with a legitimate call upon them, such as the practitioner, the Regulatory Body, or in response to a Direction from an Employment Tribunal.”

[12]In four paragraphs of the Confidential Schedule to the Particulars of Claim, the Claimant has identified the confidential information in the Proposed Disclosure. This largely consists of an identification of broad categories of information, rather than the identification of particular information which is said to be confidential. That may well simply reflect the fact that the Claimant’s breach of confidence claim is advanced on the basis that the investigation process is confidential rather than being based on the alleged confidentiality of individual pieces of information. Nevertheless, not all the information in the documents in the Proposed Disclosure is information over which the Claimant can maintain a claim of confidence. Further, resolution of disputes in this area (and, even more so, misuse of private information) almost always requires careful consideration and balancing of the competing rights: In re S

[2005] 1 AC 593

[17]. What is needed is an “intense focus” on the relevant facts “not a mechanical exercise … decided on the basis of rival generalities”: A Local Authority -v- W

[2006] 1 FLR 1

[53]. That usually requires close attention on the information the disclosure of which the claimant alleges would be wrongful, balanced against the defendant’s justification for publication (see Candy -v- Holyoake

[2017] EWHC 373 (QB)

[47]-[49]). (2). Misuse of private information

[13]In his Particulars of Claim, the Claimant states:

“For the reasons set out at paragraphs 78-81 above, the Information contained in the Documents is private. The Claimant’s conduct whilst at work, including [see confidential schedule] and disciplinary action taken in respect to him, relates to the Claimant’s private life. The Claimant had, and the Defendant was aware that the Claimant had a reasonable expectation that that information would remain private, save where disclosure was required to any regulatory or other authority.”

[14]Paragraphs 78-81 (the detail of which is set out in the Confidential Schedule) are the four paragraphs that seek to establish the confidentiality of the investigations into the Claimant and the outcome (see [12] above).

[15]Confidentiality and privacy interests may sometimes overlap, but they have important differences and can protect materially different interests: see discussion in PJS -v- News Group Newspapers Ltd

[2016] 1 AC 1081

. The law of confidence conventionally protects secrecy. Misuse of private information protects privacy. Breach of confidence can protect disclosure of information going beyond that which is private, equally the tort of misuse of private information can protect disclosure of information that is not secret. So, whereas confidentiality can potentially extend to a process – like the MHPS investigation in this case – a misuse of private information claim usually requires concentration upon the particular information that it is alleged is private. Largely, this explains why a claimant advancing a misuse of private information claim must identify clearly the information in respect of which he has a reasonable expectation of privacy and the actual or threatened disclosure of which is said to be unlawful (see CPR PD 53B §8.1 – set out in [9] above).

[16]The failure of the Claimant to identify the information in the Proposed Disclosure in respect of which he claims to have a reasonable expectation of privacy will be significant when it comes to the balancing exercise that needs to be carried out (see [101]-[103] below). (3). Data protection

[17]As to his data protection claim, the Claimant contends that both the MHPS outcome letter and Document X contain his personal data, for the purposes of the GDPR and/or Data Protection Act 2018, and that the Defendant is the data controller. The Claimant has not identified the specific personal data that he alleges would be processed unlawfully by the Proposed Disclosure (arguably in breach of CPR PD 53B §9). Instead, he contends more generally that the Proposed Disclosure: i) would amount to a breach of contract, breach of confidence and/or misuse of private information and/or breach of the Claimant’s Article 8 rights. As such, the Proposed Disclosure would be a breach of Article 5(1)(a) GDPR on the grounds that such processing would not be lawful, fair, or transparent; specifically none of the requirements of Article 6 GDPR is met in respect of the Proposed Disclosure (Articles 5 and 6 GDPR are set out below – see [46]); ii) is not necessary or relevant, being disclosure to patients whose care was not directly considered in the investigation and/or disclosure of the full MHPS outcome letter and Document X to patients who have previously only received extracts/summaries relating to their own care. As such, the Proposed Disclosure would be a breach of Article 5(1)(d) GDPR on the grounds that such processing would not be “adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed”; and iii) contains information that is not accurate. As such, the Proposed Disclosure would be a further breach of Article 5(1)(d) GDPR. The Claimant’s case as to the alleged inaccuracy of Document X is set out in a confidential exhibit to the Particulars of Claim. As to the MHPS outcome letter, the Claimant contends that he has raised significant concerns about the fairness of the process that gave rise to it “and thereby its accuracy”.

D: The Defence

[18]In its Defence (to which some minor amendments have been made by consent), the Defendant admits that the Proposed Disclosure has the necessary quality of confidence, and that it was under a duty of confidentiality (of disputed width). The Defendant disputes whether the MHPS provisions regarding confidentiality have been incorporated into the Defendant’s contract of employment, but any obligation of confidence was not absolute and could be outweighed where disclosure of the relevant information was necessary. The Defence states:

“The Claimant wrongly seeks to characterise the obligation to maintain confidentiality in relation to the MHPS investigation or its outcome as an absolute obligation rather than an obligation which may be legitimately overridden by the employing Trust in particular circumstance, inter alia: (i) where disclosure is considered by the employer to be justified in the public interest; and/or (ii) where the employing Trust reasonable considers a duty to disclose to a third party arises under a rule of law or practice regardless of whether such obligation arises by virtue of common law or statute.”

And in a subsequent paragraph:

“The duty of confidence owed to the Claimant in respect of the relevant information may be overridden by a countervailing public interest which the Defendant reasonably considers requires such disclosure to third parties: for example patient safety, the duty of candour, the Defendant’s obligations arising under the Clinical Negligence Pre-Action protocol, and/or the Defendant’s disclosure obligations under CPR 31 in relation to actual or contemplated litigation. In reaching its decision on disclosure the Defendant has taken into account that the intended disclosure is not to the public at large but to solicitors acting for claimants in actual or contemplated litigation. For clinical negligence and in circumstances where the recipients of the Proposed Disclosure whether under the pre-action protocol (because a collateral undertaking will be sought by the Defendant as a condition of disclosure under the protocol) or pursuant to CPR 31, will be under an obligation not to use or disclose the disclosed documents for purposes other than the actual or contemplated litigation.”

[19]The Defendant has been notified of a significant number of claims arising from allegations made against the Claimant in which it is alleged that the Defendant is vicariously liable for the Claimant’s acts or omissions. The Defendant contends that it: “… is required to manage such claims reasonably and proportionately and in a manner which serves the public interest, including providing timely compensation for deserving cases and avoiding unnecessary expenditure in costs”.

[20]In its Defence, the Defendant identified three cohorts of potential civil claims: i) Cohort 1: individual claimants who have intimated or issued claims for clinical negligence against the Defendant and whose medical treatment has been reviewed as part of the MHPS investigation (or otherwise). The Defendant has identified 22 patients in this Cohort. ii) Cohort 2: individual claimants, not in Cohort 1, who have notified or issued claims for clinical negligence against the Defendant where the question of informed consent to their treatment by the Claimant is likely to be an issue. The Defendant has identified 98 patients in this Cohort. iii) Cohort 3: individual claimants, not in Cohorts 1 or 2, who have notified or issued claims for clinical negligence against the Defendant where lack of informed consent is not likely to be identified as an issue. The Defendant has identified no patients in this Cohort at present.

[21]The Defence contends that: “Claimant lawyers are acting in a number of cases in parallel, and therefore disclosure in one isolated case can be expected to result in numerous requests in other cases, hence the intention to make this disclosure step to all current claimants pursuing cases against the [Defendant] about [the Claimant’s] management of their care. This is particularly relevant in respect of hybrid claims, which are not routinely being resolved pre-action and therefore the Trust is going to be brought into proceedings where it is not responsible for the treatment provided, at significant cost to the public purse. Disclosure of the [Document X] and MHPS outcome letter may impact the defendants being pursued, the allegations being advanced, and Claimants’ decisions regarding whether to discontinue claims. This has significant costs consequences for all involved”.

[22]As to the claim brought under the data protection legislation, the Defendant: i) contended that the relevant documents contained mixed data, only some of which was data concerning the Claimant, and in respect of which he could have any data protection rights; ii) admitted that it was the relevant data controller of such data under the Data Protection Act 2018 and that the Proposed Disclosure would include processing of the personal data of the Claimant contained in the relevant documents; but iii) contended that the Proposed Disclosure would be lawful – being “adequate relevant and limited to what is necessary in relation to the purposes for which they are processed”, placing reliance on Schedule 2, Part 1, paragraph 5 of the Data Protection Act 2018 and having regard to the Defendants obligations including under the Civil Procedure Rules (disclosure) and associated pre-action protocols (see further [53]-[55] below).

[23]Finally, the Defendant has stated in its defence that when it makes the Proposed Disclosure it will indicate to the recipient:

“We (the Trust) are making this disclosure in the pre-action phase of this claim, in the expectation and understanding that you, as the Claimant’s legal advisers, are receiving them solely within your client’s claim, and that you will not use them for any collateral purpose.”

E: Injunction Application

[24]The Claimant duly issued an Application Notice seeking an order in the following terms (“Interim Injunction Application”):

“(1) an injunction to restrain the Defendant… from undertaking the Proposed Disclosure unless required or expressly permitted to do so by order of the court; and (2) an order pursuant to s.167 Data Protection Act 2018 and/or Article 79 of the General Data Protection Regulation preventing the Defendant… from undertaking the Proposed Disclosure unless required or expressly permitted to do so by order of the Court.”

[25]The Interim Injunction Application was supported by the Fourth Witness Statement of Jane Lang, the Claimant’s solicitor. She set out the background that ultimately led to the dismissal of the Claimant, including the MHPS investigation. Ms Lang exhibits and refers to copies of the MHPS and the Defendant’s Disciplinary Policy to support the Claimant’s contention that the investigation process to which he was subject was conducted in circumstances of strict confidentiality. As to the litigation against the Defendant by former patients of the Claimant, Ms Lang noted that only two claims have been issued and only one of those had been served. She stated that she was unaware that there had been any applications for disclosure, whether in those issued claims or pre-action. She complained that it appeared from the Defendant’s position that it was intending to make the Proposed Disclosure to former patients in the cohorts including to those who had not requested sight of the documents. Whether such documents fell within the ambit of standard disclosure (or pre-action disclosure) would have to be determined by reference to the issues in any particular case. For example, if the Defendant admitted liability in a claim, the documents in the Proposed Disclosure may well not fall to be disclosed. This led her to suggest that the appropriate way for the Defendant to deal with the Proposed Disclosure was pursuant to orders made in the relevant clinical negligence claims. Such orders would be made only where necessary by a Judge who was fully familiar with the issues that arose in the particular claims.

[26]For the Defendant, its solicitor, Corinne Slingo, has filed a second witness statement, dated 2 September 2022. In summary, and without waiving privilege, Ms Slingo states that the Defendant has concluded that the MHPS outcome letter and Document X contain material that is relevant to the claims brought by patients in Cohorts 1 and 2 and that they should therefore be disclosed to such patients. She adds:

“disclosure of such documents is essential in order properly to comply with the [pre-action] protocol and to achieve the protocol objectives.”

[27]As to the alleged confidentiality of the documents, Ms Slingo states that the Defendant accepts that there is an expectation of confidentiality within the course of any MHPS process. However, the Defendant’s MHPS Policy – in Appendix 2c “Sharing of information and referral to other bodies” – states that:

“An appropriate level of confidentiality should be maintained at all times however, the protection of the public must underpin all decisions regarding sharing of information about a Practitioner”

Specific procedures are provided in circumstances where referrals are made to the police and/or the General Medical Council.

[28]The Defendant reviewed the care and treatment of 8 patients as part of the MHPS investigation process. Document X had already been provided to the GMC and other bodies and extracts from Document X (that concern the relevant patient) have been sent to several patients whose care was investigated.

[29]Following the Defendant’s investigation, culminating in the dismissal of the Claimant, Ms Slingo states that the Defendant considered what further steps needed to be taken by it. She states:

“18. As a result of the need to be confident that any patients potentially provided with substandard care, and potentially harmed by the Claimant’s care provided under the Trust, the Trust designated and began a recall and review process, which considered patients who had undergone a primary Laparoscopic Ventral Mesh Rectopexy (LVMR) at North Bristol NHS Trust within a 10 year window. This was a very significant review and recall process, which took place over a number of years and involved hundreds of former patients. 19. The Defendant Trust did not seek to involve the Claimant in the recall and review process, which is an entirely appropriate decision in the circumstances, and one which would be echoed nationally by any NHS Trust conducting a recall by virtue of serious concerns about the care provided to its patients by a specific consultant… 20. During the recall process, patient records were reviewed and some patients were invited to a clinical review to discuss their care. Their care was also considered by a convened panel, and conclusions were reached as to whether each patient had suffered harm. When considering if harm had occurred the panel considered whether surgery was clinically indicated, based on investigations conducted to support the diagnosis for the patient and the treatment that was then offered, whether conservative treatment should have been offered rather than offering surgery at the point it was offered, and whether the surgery appeared to be of an appropriate standard. 21. The panel’s analysis resulted in a ‘harm’ or ‘no harm’ conclusion. In this context, the panel found that harm had occurred, if the indication for performing the procedure was flawed, even where a procedure was carried out with no complications or adverse outcomes. The harm in that circumstance would be the unnecessary surgical procedure. 203 patients fell into this category and were notified by the Trust accordingly. These matters were not considered in a forensic way with a view to subsequent claims analysis, but as part of a recall process to enable the Defendant Trust to identify patients who may have received inappropriate advice and treatment, including surgery, to then be able to address any regulatory duties held by the Trust, including the statutory duty of candour. 22. For each case considered, where harm (as defined) was identified, the Defendant Trust wrote to each patient to advise them of the outcome of the recall and review process (An example letter is exhibited…) 23. This process was concluded and a report prepared by the Defendant Trust for its public Trust Board Meeting in May 2022… summarising the findings and the number of patients harmed, and communicated with. This report confirms that the helpline, set up for patients to report concerns, remains open. 24. As stated in paragraph 20 above, a number of patients whose care was reviewed within this recall process, are pursuing clinical negligence claims against the Defendant Trust, with regard to treatment provided by the Claimant. Without exception, the substance of those intimated claims relate (sic) to concerns regarding informed consent, often (but not exclusively) associated with concerns regarding treatment indications or risks.”

[30]Ms Slingo states that, at the date of her witness statement, 113 claims have been intimated by former patients of the Claimant. A significant proportion of those relate to care provided at the Defendant’s hospital, but some claims relate to care provided both by the Defendant and within the independent sector as a result of the Claimant holding practising privileges at a private hospital. Ms Slingo identifies this latter category of claim as “hybrid cases” in which both the Defendant and the Claimant individually are the proposed defendants to the threatened clinical negligence claim. In such hybrid cases, Ms Slingo suggests that the Claimant will have received letters of claim which will have identified the issues of concern. Exhibited to her witness statement are examples of requests for disclosure (both generic and specific) that the Defendant has received from patients’ representatives instructed in relation to threatened clinical negligence claims in both hybrid and non-hybrid cases.

[31]Ms Slingo states that the number of claimants who have notified potential claims is significant and that, in consequence, NHS Resolution, the body that indemnifies NHS Trusts in respect of clinical negligence claims, decided that there was need for an Alternative Dispute Resolution protocol, which commenced in 2018. This is designed, Ms Slingo states, “to provide an efficient approach to claims so that patients have more rapid access to, and resolution of, claims arising purely from NHS care.” Hybrid cases are excluded from the process.

[32]Ms Slingo states that the Defendant has cooperated with the creation of the ADR protocol. The purpose of the ADR protocol is, she explains, to attempt to streamline the cases so that they can be dealt with effectively and without the need for individualised case management of claims. She states that most of the claimant firms, who are pursuing claims on behalf of patients, have also agreed to the ADR protocol. She therefore rejects the suggestion, made by Ms Lang, that each patient ought to be required to make an application to the Court to obtain and order for disclosure of the documents containing the Confidential Information. Ms Slingo says:

“The clear public interest lies in being able to facilitate resolution of these claims for affected patients, either way. It is also contrary to the approach mandated by the pre-action protocol in the CPR, which requires a ‘cards on the table’ approach and the exchange of information and documents so as to enable each party to understand the case of the other and with a view to avoiding unnecessary litigation.”

[33]As part of the claims process, Ms Slingo reports that the Defendant has received several requests for disclosure in the pre-action phase both of a generic nature and, in some instances, specific requests for the one or both of the MHPS outcome letter and Document X. She exhibited examples, including specific requests demonstrating that at least some firms representing claimants are aware of the existence of Document X sufficient to be able to make a specific request for it. F: Legal Principles (1). Breach of confidence

[34]There is a measure of agreement between the parties as to the principles that apply to a claim for breach of confidence, whether brought as a contractual claim or under the equitable duty of confidence.

[35]For a claim for breach of confidence, three elements must be established: i) the information has the necessary quality of confidence; ii) it was communicated in circumstances importing an obligation of confidence; and iii) the Defendant is threatening to use the confidential information to the detriment of the Claimant. Coco -v- A. N. Clark (Engineers) Ltd

[1968] FSR 415

, 419-421.

[36]There must be threatened, or actual, misuse of the information alleged to be confidential. This has been described as the “unauthorised use of the information to the detriment of the person communicating it”: Cocoat p.421; and “unconscientious use has been made of the information”: Smith Kline and French Laboratories -v- Secretary to the Department of Community Services and Health (1991) 99 ALR 679, 691-692.

[37]Simon Brown LJ reviewed the authorities in R -v- Department of Health ex parte Source Informatics Ltd

[2001] QB 424

[24]-[30] and concluded, at [31]:

“To my mind the one clear and consistent theme emerging from all these authorities is this: the confidant is placed under a duty of good faith to the confider and the touchstone by which to judge the scope of his duty and whether or not it has been fulfilled or breached is his own conscience, no more and no less. One asks, therefore, on the facts of this case: would a reasonable pharmacist’s conscience be troubled by the proposed use to be made of patients’ prescriptions? Would he think that by entering Source’s scheme he was breaking his customers’ confidence, making unconscientious use of the information they provide?”

[38]If a duty of confidence is established, it may nevertheless be negated by, or qualified in, the public interest: Attorney General -v- Observer Limited

[1990] 1 AC 109

, 268, 282G-283B (“Spycatcher”); Imutran Ltd -v- Uncaged Campaigns Ltd

[2002] 2 All ER 385

[20]. In W -v-Edgell

[1990] Ch 359

, 419-420 Bingham LJ explained:

“The decided cases very clearly establish: (1) that the law recognises an important public interest in maintaining professional duties of confidence; but (2) that the law treats such duties not as absolute but as liable to be overridden where there is held to be a stronger public interest in disclosure. Thus the public interest in the administration of justice may require a clergyman, a banker, a medical man, a journalist or an accountant to breach his professional duty of confidence: Attorney-General -v- Mulholland Attorney-General -v- Foster [1963] 2 QB 477, 489-490, and Chantrey Martin -v- Martin [1953] 2 QB 286. In Parry-Jones -v- Law Society [1969] 1 Ch 1 a solicitor’s duty of confidence towards his clients was held to be overridden by his duty to comply with the law of the land, which required him to produce documents for inspection under the Solicitors’ Accounts Rules. A doctor’s duty of confidence to his patient may be overridden by clear statutory language (as in Hunter -v- Mann [1974] QB 767). A banker owes his customer an undoubted duty of confidence, but he may become subject to a duty to the public to disclose, as where danger to the state or public duty supersede the duty of agent to principal: Tournier -v- National Provincial and Union Bank of England [1924] 1 KB 461, 473, 486. An employee may justify breach of a duty of confidence towards his employer otherwise binding upon him when there is a public interest in the subject matter of his disclosure: Initial Services Ltd. -v- Putterill [1968] 1 QB 396and Lion Laboratories -v- Evans [1985] QB 526. These qualifications of the duty of confidence arise not because that duty is not accorded legal recognition but for the reason clearly given by Lord Goff of Chieveley in his “Spycatcher” speech [at] 282…: ‘The third limiting principle is of far greater importance. It is that, although the basis of the law’s protection of confidence is that there is a public interest that confidences should be preserved and protected by the law, nevertheless that public interest may be outweighed by some other countervailing public interest which favours disclosure. This limitation may apply, as the learned judge pointed out, to all types of confidential information. It is this limiting principle which may require a court to carry out a balancing operation, weighing the public interest in maintaining confidence against a countervailing public interest favouring disclosure.’” ‘The third limiting principle is of far greater importance. It is that, although the basis of the law’s protection of confidence is that there is a public interest that confidences should be preserved and protected by the law, nevertheless that public interest may be outweighed by some other countervailing public interest which favours disclosure. This limitation may apply, as the learned judge pointed out, to all types of confidential information. It is this limiting principle which may require a court to carry out a balancing operation, weighing the public interest in maintaining confidence against a countervailing public interest favouring disclosure.’”

[39]In balancing the competing interests, contractual obligations of confidence may be given greater weight: ABC -v- Telegraph Media Group Ltd [2019] EMLR 5 [21]-[24]; and Saab -v- Dangate Consulting Ltd [2019] PNLR 259 [29]. Conversely, mere allegations of wrongdoing are unlikely to be sufficient to outweigh an obligation of confidence: Spycatcher 282-283.

[40]A contract of employment, such as that between the Claimant and Defendant, would ordinarily be found to contain an implied term that the Defendant would not “without reasonable and proper cause, conduct itself in a manner calculated or likely to destroy or seriously damage the relationship of confidence and trust between employer and employee”: Malik -v- BCCI

[1998] AC 20

, 45F-G.

[41]Nevertheless, any express or implied term as to confidentiality may be subject to other qualifications either by further implied terms of a contract or by operation of law (e.g. an order for disclosure): Tournier -v- National Provincial and Union Bank

[1924] 1 KB 461

, 486 per Atkin LJ:

“… I think it safe to say that the obligation not to disclose information such as I have mentioned is subject to the qualification that the bank have the right to disclose such information when, and to the extent to which it is reasonably necessary for the protection of the bank’s interests, either as against their customer or as against third parties in respect of transactions of the bank for or with their customer, or for protecting the bank, or persons interested, or the public, against fraud or crime.”

[42]The Defendant has general obligations, particularly regarding patient safety, that may require disclosure of information, originally provided in confidence, to patients and/or to the public to protect patient safety and/or to discharge its duty of candour under the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014. Paragraph 1 of Regulation 20 imposes a general duty of candour on the Defendant to “act in an open and transparent way with relevant persons in relation to care and treatment to service users in carrying on a regulated activity” (“the Duty of Candour”). The Duty of Candour, which came into force on 27 November 2014, applies to all NHS bodies registered with the Care Quality Commission. Paragraphs 2-9 of Regulation 20 impose further specific duties in the event of a “notifiable safety incident” (defined in Paragraph 8).

[43]The existence and extent of a contractual obligation of confidence and whether an implied contractual (or equitable) obligation of confidentiality arising from an employment contract extends to the disclosure in question by asking whether an express term prohibiting the disclosure would have been contrary to public policy: Initial Services -v- Putterill

[1968] 1 QB 396

, 411. (2). Misuse of private information

[44]In relation to the claim for misuse of private information, there is a two-stage test: i) does the claimant have a reasonable expectation of privacy in the relevant information, and, if so; ii) is that outweighed by countervailing interests? ZXC -v- Bloomberg LC

[2022] AC 1158

[26]. (3). Data Protection

[45]It is common ground that(a) the Proposed Disclosure would involve publication of material that includes some (albeit unparticularised) personal data relating to the Claimant; and

(b) that the Defendant is the data controller of that personal data.

[46]Articles 5 and 6 of the UK GDPR provide:

“5. Principles relating to processing of personal data (1) Personal data shall be: (a) processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’); (b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes (‘purpose limitation’); (c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’); (d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’); (e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject (‘storage limitation’); (f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’). (2) The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’). 6. Lawfulness of processing (1) Processing shall be lawful only if and to the extent that at least one of the following applies: (a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes; (b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; (c) processing is necessary for compliance with a legal obligation to which the controller is subject; (d) processing is necessary in order to protect the vital interests of the data subject or of another natural person; (e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the performance of their tasks. … (3) The basis for the processing referred to in point (c) and (e) of paragraph 1 shall be laid down by domestic law. The purpose of the processing shall be determined in that legal basis or, as regards the processing referred to in point (e) of paragraph 1, shall be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. That legal basis may contain specific provisions to adapt the application of rules of this Regulation, inter alia: the general conditions governing the lawfulness of processing by the controller; the types of data which are subject to the processing; the data subjects concerned; the entities to, and the purposes for which, the personal data may be disclosed; the purpose limitation; storage periods; and processing operations and processing procedures, including measures to ensure lawful and fair processing such as those for other specific processing situations as provided for in Chapter IX. The domestic law shall meet an objective of public interest and be proportionate to the legitimate aim pursued. (4) Where the processing for a purpose other than that for which the personal data have been collected is not based on the data subject’s consent or on domestic law which constitutes a necessary and proportionate measure in a democratic society to safeguard national security, defence or any of the objectives referred to in Article 23(1), the controller shall, in order to ascertain whether processing for another purpose is compatible with the purpose for which the personal data are initially collected, take into account, inter alia: (a) any link between the purposes for which the personal data have been collected and the purposes of the intended further processing; (b) the context in which the personal data have been collected, in particular regarding the relationship between data subjects and the controller; (c) the nature of the personal data, in particular whether special categories of personal data are processed, pursuant to Article 9, or whether personal data related to criminal convictions and offences are processed, pursuant to Article 10; (d) the possible consequences of the intended further processing for data subjects; (e) the existence of appropriate safeguards, which may include encryption or pseudonymisation.” (a) processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’); (b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes (‘purpose limitation’); (c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’); (d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’); (e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject (‘storage limitation’); (f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’). (a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes; (b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; (c) processing is necessary for compliance with a legal obligation to which the controller is subject; (d) processing is necessary in order to protect the vital interests of the data subject or of another natural person; (e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the performance of their tasks. … (a) any link between the purposes for which the personal data have been collected and the purposes of the intended further processing; (b) the context in which the personal data have been collected, in particular regarding the relationship between data subjects and the controller; (c) the nature of the personal data, in particular whether special categories of personal data are processed, pursuant to Article 9, or whether personal data related to criminal convictions and offences are processed, pursuant to Article 10; (d) the possible consequences of the intended further processing for data subjects; (e) the existence of appropriate safeguards, which may include encryption or pseudonymisation.”

[47]The material parts of the Data Protection Act 2018 provide:

“s.8 Lawfulness of processing: public interest etc. In Article 6(1) of the UK GDPR (lawfulness of processing), the reference in point (e) to processing of personal data that is necessary for the performance of a task carried out in the public interest or in the exercise of the controller’s official authority includes processing of personal data that is necessary for – (a) the administration of justice, (b) the exercise of a function of either House of Parliament; (c) the exercise of a function conferred on a person by an enactment or rule of law, (d) the exercise of a function of the Crown, a Minister of the Crown or a government department, or (e) an activity that supports or promotes democratic engagement. … s.15 Exemptions etc. (1) Schedules 2, 3 and 4 make provision for exemptions from, and restrictions and adaptations of the application of, rules of the UK GDPR… Schedule 2 Exemptions etc. from the UK GDPR (1) In this Part of this Schedule, “the listed GDPR provisions” means— (a) the following provisions of the UK GDPR (the rights and obligations in which may be restricted by virtue of Article 23(1) of the UK GDPR)— (i) Article 13(1) to (3) (personal data collected from data subject: information to be provided); (ii) Article 14(1) to (4) (personal data collected other than from data subject: information to be provided); (iii) Article 15(1) to (3) (confirmation of processing, access to data and safeguards for third country transfers); (iv) Article 16 (right to rectification); (v) Article 17(1) and (2) (right to erasure); (vi) Article 18(1) (restriction of processing); (vii) Article 19 (notification obligation regarding rectification or erasure of personal data or restriction of processing); (viii) Article 20(1) and (2) (right to data portability); (ix) Article 21(1) (objections to processing); (x) Article 5 (general principles) so far as its provisions correspond to the rights and obligations provided for in the provisions mentioned in sub-paragraphs (i) to (ix); and (b) the following provisions of the UK GDPR (the application of which may be adapted by virtue of Article 6(3) of the UK GDPR)— (i) Article 5(1)(a) (lawful, fair and transparent processing), other than the lawfulness requirements set out in Article 6; (ii) Article 5(1)(b) (purpose limitation). … (5) Information required to be disclosed by law etc or in connection with legal proceedings (1) The listed GDPR provisions do not apply to personal data consisting of information that the controller is obliged by an enactment to make available to the public, to the extent that the application of those provisions would prevent the controller from complying with that obligation. (2) The listed GDPR provisions do not apply to personal data where disclosure of the data is required by an enactment, a rule of law or an order of a court or tribunal, to the extent that the application of those provisions would prevent the controller from making the disclosure. (3) The listed GDPR provisions do not apply to personal data where disclosure of the data— (a) is necessary for the purpose of, or in connection with, legal proceedings (including prospective legal proceedings), (b) is necessary for the purpose of obtaining legal advice, or (c) is otherwise necessary for the purposes of establishing, exercising or defending legal rights, to the extent that the application of those provisions would prevent the controller from making the disclosure.”

Schedule 2 Exemptions etc. from the UK GDPR (a) the following provisions of the UK GDPR (the rights and obligations in which may be restricted by virtue of Article 23(1) of the UK GDPR)— (i) Article 13(1) to (3) (personal data collected from data subject: information to be provided); (ii) Article 14(1) to (4) (personal data collected other than from data subject: information to be provided); (iii) Article 15(1) to (3) (confirmation of processing, access to data and safeguards for third country transfers); (iv) Article 16 (right to rectification); (v) Article 17(1) and (2) (right to erasure); (vi) Article 18(1) (restriction of processing); (vii) Article 19 (notification obligation regarding rectification or erasure of personal data or restriction of processing); (viii) Article 20(1) and (2) (right to data portability); (ix) Article 21(1) (objections to processing); (x) Article 5 (general principles) so far as its provisions correspond to the rights and obligations provided for in the provisions mentioned in sub-paragraphs (i) to (ix); and (b) the following provisions of the UK GDPR (the application of which may be adapted by virtue of Article 6(3) of the UK GDPR)— (i) Article 5(1)(a) (lawful, fair and transparent processing), other than the lawfulness requirements set out in Article 6; (ii) Article 5(1)(b) (purpose limitation). … (a) is necessary for the purpose of, or in connection with, legal proceedings (including prospective legal proceedings), (b) is necessary for the purpose of obtaining legal advice, or (c) is otherwise necessary for the purposes of establishing, exercising or defending legal rights, to the extent that the application of those provisions would prevent the controller from making the disclosure.”

Schedule 2 Exemptions etc. from the UK GDPR

[48]Neither party has referred me to any authority that has bearing on the data protection issues that I have to determine. (4). Disclosure in the course of threatened or actual proceedings

[49]A point that became important during the hearing was the Claimant’s contention that the Proposed Disclosure should be made only in response to an order made by the Court in actual or threatened proceedings by any Cohort claimants, whether such order was made pre-action, under CPR 31.16 or in the usual way after proceedings had commenced.

[50]CPR 31.16(3) provides that, following an application, an order for pre-action disclosure can be made by the Court only if the following conditions are satisfied: i) both the applicant and respondent are likely to be parties to subsequent proceedings; ii) if proceedings had started, the respondent’s duty by way of standard disclosure under CPR 31.6 would extend to the documents or classes of document sought by the applicant; and iii) pre-action disclosure is desirable in order(a) to dispose fairly of the anticipated proceedings;

(b) to assist the dispute to be resolved without proceedings; or

[51]An order for standard disclosure under CPR 31.6, once proceedings have been started, requires a party to disclose only: i) the documents upon which he relies; ii) the documents which(a) adversely affect his own case;

(b) adversely affect another party’s case; or

[52]It is usually only possible to make the assessment of the documents that fall within standard disclosure after the issues in the litigation have crystallised following the exchange of statements of case. An applicant making an application for pre-action disclosure must show that it is more probable than not that the documents would fall within the scope of standard disclosure should an action commence: Hutchison 3G UK Ltd -v- O2 (UK) Ltd

[2008] EWHC 55 (Comm)

[53]A separate, but voluntary, regime for pre-action disclosure is promoted in various pre-action protocols. In the Clinical Negligence Protocol, the general aims are stated as (§2.1):

“(a) to maintain and/or restore the patient/healthcare provider relationship in an open and transparent way; (b) to reduce relay and ensure that costs are proportionate; and (c) to resolve as many disputes as possible without litigation.”

[54]The specific objectives stated in §2.2 include:

“(a) to encourage openness, transparency and early communication of the perceived problem between patients and healthcare providers; … (c) to ensure that sufficient medical and other information is disclosed promptly by both parties to enable each to understand the other’s perspective and case, and to encourage early resolution or a narrowing of the issues in dispute; … (f) to enable the parties to avoid litigation by agreeing a resolution of the dispute; (g) to enable the parties to explore the use of mediation or to narrow the issues in dispute before proceedings are commenced…”

[55]The protocol states (§5.1) that litigation should be the last resort and the parties are required to consider whether negotiation or other form of alternative dispute resolution (“ADR”) might enable them to resolve their dispute without the need for proceedings. (5). Interim injunction

[56]When considering whether to grant an interim injunction, the Court will usually apply the well-established test from American Cyanamid -v- Ethicon Ltd (No.1)

[1975] AC 396

:(a) is there a serious issue to be tried?

(b) would damages be an adequate remedy?

[57]A more exacting test is required in certain types of case. Where the injunction sought may interfere with freedom of expression, the test is not that under American Cyanamid but that provided in s.12(3) Human Rights Act 1998. Section 12 provides: “12 Freedom of expression.(1) This section applies if a court is considering whether to grant any relief which, if granted, might affect the exercise of the Convention right to freedom of expression.

(2) If the person against whom the application for relief is made (“the respondent”) is neither present nor represented, no such relief is to be granted unless the court is satisfied— (a) that the applicant has taken all practicable steps to notify the respondent; or (b) that there are compelling reasons why the respondent should not be notified.

(3) No such relief is to be granted so as to restrain publication before trial unless the court is satisfied that the applicant is likely to establish that publication should not be allowed.

(4) The court must have particular regard to the importance of the Convention right to freedom of expression and, where the proceedings relate to material which the respondent claims, or which appears to the court, to be journalistic, literary or artistic material (or to conduct connected with such material), to— (a) the extent to which— (i) the material has, or is about to, become available to the public; or (ii) it is, or would be, in the public interest for the material to be published; (b) any relevant privacy code. (a) that the applicant has taken all practicable steps to notify the respondent; or (b) that there are compelling reasons why the respondent should not be notified. (a) the extent to which— (i) the material has, or is about to, become available to the public; or (ii) it is, or would be, in the public interest for the material to be published; (b) any relevant privacy code.

(5) In this section— “court” includes a tribunal; and “relief” includes any remedy or order (other than in criminal proceedings).

[58]“Likely” in s.12(3) means “more likely than not”: Cream Holdings Ltd -v- Banerjee

[2005] 1 AC 253

. Warby J summarised the position for the Court at the interim stage in YXB -v- TNO

[2015] EWHC 826 (QB)

[9]:

“The test that has to be satisfied by the claimant on any application for an injunction to restrain the exercise of free speech before trial is that he is ‘likely to establish that publication should not be allowed’: [s.12(3)]. This normally means that success at trial must be shown to be more likely than not: Cream Holdings … In some cases it may be just to grant an injunction where the prospects of success fall short of this standard; for instance, if the damage that might be caused is particularly severe, the court will be justified in granting an injunction if the prospects of success are sufficiently favourable to justify an order in the particular circumstances of the case: see Cream at [19], [22]. But ordinarily a claimant must show that he will probably succeed at trial, and the court will have to form a provisional view of the merits on the evidence available to it at the time of the interim application.”

[59]“Publication” in s.12(3) is not restricted to commercial publication; it applies to any method of communication that would engage Article 10: Birmingham City Council -v- Afsar

[2019] ELR 373

[60]-[61] per Warby J. “In the law of defamation, ‘publication does not mean commercial publication, but communication to a reader or hearer other than the claimant’: Lachaux -v- Independent Print Ltd

[2020] AC 612

[18] (Lord Sumption). This is generally true of the torts associated with the communication of information, sometimes known as ‘publication torts’, and the related law (see the discussion in Aitken -v- DPP

[2016] 1 WLR 297

[41]-[62]). Parliament must be taken to have legislated against this well-established background. Section 12(3) applies to any application for prior restraint of any form of communication that falls within

Article 10 of the Convention

... [T]here can be no doubt as to the materiality of s.12(3) in this case. It contains a statutory prohibition on the grant of a pre-trial injunction which interferes with freedom of expression, unless the Court is satisfied that the claimant is likely to obtain a final injunction…”

[60]Insofar as the Claimant’s claim is based upon breach of confidence, then, as an equitable remedy, the Court may decline to grant relief (or limit the terms of that relief) on grounds which may include: i) a claimant’s own conduct is not such as to merit relief because there is a clear public interest in disclosure: Church of Scientology -v- Kaufman

[1972] FSR 591

, 596 per Goff J; and/or ii) the relief claimed would cause injustice to a defendant who has acted in good faith: Lipkin Gorman -v- Karpnale Ltd

[1991] 2 AC 548

, 577-580. (6). Reputational harm?

[61]A potential issue arises as to the nature of the ‘detriment’ that the Claimant is relying upon in his breach of confidence claim. It is clear from the Particulars of Claim that a significant part of the harm that the Claimant contends would be caused to him by the Proposed Disclosure is reputational (see [7] above). Indeed, one of the focuses of the Claimant’s witness evidence is upon the alleged falsity of some of the investigation conclusions about his conduct.

[62]Interim injunctions to restrain defamatory publications are subject to an even higher threshold than s.12(3) Human Rights Act 1998: Bonnard -v- Perryman

[1891] 2 Ch 269

; Greene -v- Associated Newspapers Ltd

[2005] QB 972

(“the defamation rule”).In such cases, at the interim stage, if the defendant says that s/he will defend the publication as protected by any of the defences at common law or in ss.2-4 Defamation Act 2013 (truth, honest opinion, publication on a matter of public interest), the Court will not grant an injunction to prevent publication of defamatory words unless the claimant can demonstrate that his/her claim is “bound to succeed”: Birmingham City Council -v- Afsar

[2019] ELR 373

[62] per Warby J. A claimant cannot avoid the defamation rule by framing his/her claim in alternative causes of action. The Court will scrutinise the claim being made by a claimant to determine whether the ‘nub’ of the claim is the protection of reputation and therefore subject to the stricter rules: LJY -v- Persons Unknown

[2017] EWHC 3230 (QB)

[41]-[43]; Khan -v- Khan

[2018] EWHC 241 (QB)

[69]-[72]; Sicri -v- Associated Newspapers Ltd

[2021] 4 WLR 9

[157]

[63]A further point potentially arises from a comparison of the causes of action relied upon by the Claimant and defamation. The Proposed Disclosure would amount to publication in the law of defamation. The nature of the Proposed Disclosure, and the relationship between the Defendant and the publishees, would mean that, if it were sued for libel, the Defendant could be expected to defend the publication based on common law qualified privilege on the grounds that the Defendant was under a duty to make the Proposed Disclosure and that the recipients would have a corresponding interest to receive the information: see, generally, Chapter 15, Section 2 Gatley on Libel & Slander (13th edition, 2022, Sweet & Maxwell). Qualified privilege on this basis is granted by the law recognising the public interest in certain communications. The classic statement of the law can be found in the judgment of Parke B in Toogood -v- Spyring (1834) 1 CM&R 181, 193:

“In general, an action lies for the malicious publication of statements which are false in fact, and injurious to the character of another …, and the law considers such publication as malicious, unless it is fairly made by a person in the discharge of some public or private duty, whether legal or moral, or in the conduct of his own affairs, in matters where his interest is concerned. In such cases, the occasion prevents the inference of malice, which the law draws from unauthorised communications, and affords a qualified defence depending upon the absence of actual malice. If fairly warranted by any reasonable occasion or exigency, and honestly made, such communications are protected for the common convenience and welfare of society; and the law has not restricted the right to make them within any narrow limits.”

[64]It seems to me that, where possible, the law should strive for coherence, particularly where it is clear there is a common objective underpinning the applicable principles. It might be thought to be an odd outcome, were the conclusion to be reached, that the Defendant was under a duty to make the Proposed Disclosure, sufficient to afford a defence of qualified privilege to an action for defamation, yet it had no defence, in respect of the same disclosure, to claims based on breach of contract, confidence, misuse of private information and/or data protection. I will consider this further below. G: Submissions (1). Breach of confidence/Misuse of private information

[65]In relation to the Claimant’s claim for breach of confidence, Mr Cheetham KC contends that the Defendant is under contractual duties of confidentiality towards the Claimant by reason of the MHPS, which contains express (alternatively, implied) terms as to confidentiality. To the extent that the Defendant’s own MHPS guide conflicts with MHPS, then precedence is to be given to the latter: Kulkarni -v- Milton Keynes Hospital NHS Foundation Trusts

[2010] ICR 101

[48] and [57] per Smith LJ. In the alternative, the Defendant is under an equitable duty of confidence towards the Claimant. The Claimant accepts that any duty of confidence, whether under his employment contract or by application of the equitable principles, is not absolute.

[66]In terms of the balancing of countervailing rights, Mr Cheetham KC submits: i) There are no patient safety issues justifying disclosure. Disclosure has already been made to the GMC. ii) The Defendant has already complied with the Duty of Candour. iii) The Defendant has not shown that the Proposed Disclosure is necessary for compliance with any legal obligation. iv) The Defendant has not shown that the Proposed Disclosure is required for the purposes of any pre-action protocol or CPR Part 31 and, in any event, facilitation of private litigation is not an act in the public interest.

[67]Mr Cheetham KC included in his skeleton argument a section on the Proposed Disclosure being a breach of the Claimant’s Article 8 rights, capable of being enforced against the Defendant as a public authority under s.6 Human Rights Act 1998. In oral submissions, he did not press these arguments recognising, rightly in my view, that they add nothing to the other causes of action upon which the Claimant bases his interim injunction application.

[68]The Defendant accepts that the Proposed Disclosure will include information that is confidential, and which might cause detriment to the Claimant. However, Mr Hyam KC contends that there was no express obligation of confidence in the employment contract, the Claimant must rely upon an implied term of trust and confidence. The only relevant provision in the Defendant’s MHPS procedure is the statement that “an appropriate level of confidentiality should be maintained at all times” but this is expressly qualified by a recognition that this confidentiality might need to yield in the interests of protection of the public. Therefore, any duty of confidentiality owed in respect of the MHPS process or Document X was never absolute and was always subject to countervailing reasons for disclosure to third parties (whether regulators, patients or others).

[69]Mr Hyam KC contends that the Defendant has reasonably considered that the Proposed Disclosure is necessary (and proportionate) in order to comply with the relevant pre-action protocol. The reasons given in Ms Slingo’s evidence are compelling. Any duty of confidence that the Claimant could establish in respect of the relevant documents would be negatived by the public interest in disclosure. Any implied term which purports to prevent such disclosure would be unenforceable. No reasonable person’s conscience would be troubled by the Proposed Disclosure.

[70]However, Mr Hyam KC submits that there are specific requirements placed on the Defendant which mean that it is under a duty to make the Proposed Disclosure. i) In addition to the Duty of Candour (see [42] above), the Defendant has general obligations to its patients to respond promptly to any complaints made by patients in respect of services provided by the Defendant or by consultant surgeons employed by it (including the Claimant) and in doing so may reasonably consider it appropriate to disclose information originally provided in confidence to such patients and/or a relevant regulator or Ombudsman in response to such complaints. The standard of review of the Defendant’s determination of what disclosure is reasonably necessary is the Wednesbury test: Al Mishlab -v- Milton Keynes NHS Foundation Trust [2015] EWHC (QB) [88]. ii) The Defendant also has obligations to patients (or, if deceased, their next of kin) and/or their legal representatives who notify it of actual or contemplated litigation in respect of treatment received from a consultant surgeon (acting on its behalf) to provide disclosure of documents in its possession which are considered by the Defendant to be reasonably necessary in order to comply with(a) the relevant pre-action protocols (including the clinical negligence pre-action protocol; and/or

(b) obligations of disclosure arising under CPR Part 31 (whether, pre-action, standard or specific disclosure); and/or

[71]Mr Hyam KC argues that the processing of the Claimant’s data by the Proposed Disclosure would be lawful pursuant to GDPR Article 6(1)(c) and (e) and the Defendant also relies upon the exemption in Schedule 2, Part 1, paragraph 5 of the Data Protection Act 2018.

[72]Mr Cheetham KC made four points in response.

[73]First, all elements of Article 5 must be complied with: i) Under Article 5(1)(a), data must be processed not only lawfully, but also “fairly” and “transparently”. The Claimant argues that he has been provided with little information about what data is to be provided to whom, save that it is being provided to unnamed previous patients whose claims he knows little or nothing about. As such, the processing is not “transparent”. ii) The Proposed Disclosure is further processing, so the Defendant, as data controller, must show why that would not be incompatible with the original purpose of the processing of data in the Confidential Information, which it accepts was part of a confidential process. The Claimant argues that the MHPS investigation, MHPS Outcome letter and Document X were for the purpose of investigating allegations made against the Claimant in the employment context. They were not produced for the purpose of subsequent litigation. iii) Under Article 5(1)(c), personal data shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed. The Proposed Disclosure is not “necessary”. GDPR Recital 39 states that “the specific purposes for which personal data are processed should be explicit and legitimate and determined at the time of the collection of the personal data”. The Defendant has provided no evidence to support the proposition that the Proposed Disclosure was one of the purposes of processing that was determined at the point when the data contained in the Confidential Documents was collected.

[74]Second, processing is lawful under Article 6(1)(c) where, “processing is necessary for compliance with a legal obligation to which the controller is subject”. Mr Cheetham KC argues that the Defendant has not identified the legal obligation to which it is subject that requires it to process the Claimant’s personal data through the proposed disclosure. GDPR Recital 45 states:

“Where processing is carried out in accordance with a legal obligation to which the controller is subject or where processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority, the processing should have a basis in Union or Member State law”

. Mr Cheetham KC contends that there is no obvious basis on the facts of this case.

[75]Third, the Defendant’s reliance upon Article 6(1)(e) is misplaced. In correspondence, it has been contended that, “the negotiation of settlement of potential claims is a relevant public task under Article 6(1)(e)”. However, under s.8 Data Protection Act 2018, only “the administration of justice” could be relevant. The Claimant submits that the Defendant is not involved in the administration of justice which is not the same thing as the settlement of private disputes. Further, Article 6(1)(e) is subject to Article 6(3), which requires the basis for the processing to be, “laid down by domestic law”. Mr Cheetham KC argues that the Defendant has not set out what law it relies upon and, instead, has simply identified its responsibility as a public body to comply with the pre-action protocol. Further, even if this were “a task carried out in the public interest”,the processing would still need to be “necessary”, which the Claimant contends it has failed to do. The purpose of the pre-action protocol is to regulate the conduct of litigation, but what is necessary to disclose will differ from case to case. The mere existence of claims and potential claims and the wish to negotiate settlement of those claims, where liability may or may not be admitted, cannot make the processing “necessary” (as opposed to helpful or expedient).

[76]Fourth, the exemption provided by Schedule 2, Part 1, Paragraph 5 only applies to “the listed GDPR provisions”. Mr Cheetham KC contends that none of the listed provisions applies, which means that the exemption does not apply either. In any event, the effect of Paragraph 5 would be, for example, to exempt the controller from otherwise having to disclose personal data, not to provide a lawful basis for that disclosure. Further, and in any event, the Defendant has failed to identify which part of Paragraph 5 applies, given that the controller is not obliged by an enactment, a rule of law, an order of a court or tribunal to make the proposed disclosure and it has not shown why it would be “necessary” for the purpose of legal proceedings. (3). Disclosure in the course of threatened or actual proceedings

[77]Mr Cheetham KC argued that there is and can be no justification for the Proposed Disclosure until such time as the relevant documents fall to be disclosed to any of the Cohort claimants, pursuant to an order of the Court, whether in the course of litigation that any of them may bring or pre-action pursuant to CPR 31.16. He contends that this is the appropriate stage for disclosure of the relevant documents to be made as it will ensure that the Court is satisfied that such disclosure is necessary. It is only at that point that the Court will properly be able to weigh up the countervailing interests as part of consideration of any application for disclosure. If the Defendant were to admit liability in any of the Cohort claims, then the Proposed Disclosure would not be required under CPR 31.6. Further, Mr Cheetham KC argues that the Proposed Disclosure would not fall within CPR 31.6 for any claimants in Cohort 2. He contends that only the parts of the documents that address an individual’s care are relevant and those have already been disclosed.

[78]Mr Cheetham KC relied upon Richmond Pharmacology Ltd -v- Chester Overseas Ltd [2014] BusLR 1110 [52]-[54] to support a submission that where there is an express confidentiality restriction, subject only to an exception when “required by law”, such a term is to be construed narrowly.

[79]Mr Cheetham KC argues that the pre-action protocol does not require the Proposed Disclosure. Although the pre-action protocol does not define “clinical records”, the definitions of “health record” under s.1 Access to Health Records Act 1990 and s.205 Data Protection Act 2018 would not include the documents in the Proposed Disclosure.

[80]Mr Hyam KC’s response on this point is that prohibiting the voluntary step of the Proposed Disclosure and requiring potential claimants to apply to Court for a disclosure

[81]The Claimant argues that he is likely to demonstrate at trial that the Proposed Disclosure should not be allowed. As such, the remaining factors support the grant of an interim injunction. Damages would not be an adequate remedy.

[82]The Defendant contends that the Claimant’s own misconduct, identified in the Proposed Disclosure, is not such as to merit relief. There is a strong public interest justification for the proposed disclosure and in such circumstances such public interest “is a very telling factor weighing against the grant of an interlocutory injunction”:Church of Scientology -v- Kaufman

[1972] FSR 591

. Further, the relief claimed would cause injustice to the Defendant (who has acted in good faith and is seeking to comply with the obligations upon it under the CPR and pre-action protocol, and has entered into an ADR scheme to seek to resolve disputed issues in intended group litigation which should be allowed to proceed without unjust impediment.

H: Decision

[83]The issue in this case is whether, on the various legal grounds advanced, the Claimant can prohibit the Proposed Disclosure or, more accurately at this interim stage and applying the test under s.12, whether he can demonstrate that he is likely to succeed at trial in demonstrating that the Proposed Disclosure should not be allowed. At this interim stage, the Court is not making any findings beyond what are necessary to make the threshold determination under s.12. I am determining only whether the Claimant should be granted an interim injunction. The ultimate determination as to the merits of his claim, and any final remedy he might be entitled to, must await trial. (1). Breach of Confidence/Breach of Contract

[84]I can take these claims together as they both rely on the contention that the Proposed Disclosure would be a breach of confidence. The only material difference between the two causes of action is how the alleged duty of confidentiality is said to arise: whether by contract or by operation of equitable principles.

[85]The Claimant’s claim for breach of contract relies either upon the incorporation of MHPS into his contract of employment or upon the implication of similar terms of confidentiality. It is common ground that the Claimant was owed at least some obligation of confidence arising from the MHPS process. However, and as Mr Cheetham KC recognises, any such duty of confidence, could not be absolute. Under MHPS, for example, the obligation was subject to an exception that records could be made available to those “with a legitimate call upon them”. Analysed as an equitable obligation of confidence, the result is the same.

[86]I therefore turn to consider the elements of a claim for breach of confidence (see [35] above) before turning to consider whether any duty of confidence is likely to be outweighed by other considerations. (a). Does the information have the necessary quality of confidence?

[87]The Claimant has not identified the precise information the disclosure of which in the Proposed Disclosure would be a breach of confidence. Nevertheless, I accept that, from the evidence at this stage, that the Claimant is likely to succeed in demonstrating that the Proposed Disclosure will include at least some information that would have the necessary quality of confidence and over which he could claim confidentiality. In this category, most significantly, is likely to fall any explanation he gave for his actions in the investigation. An investigation conducted under MHPS would, prima facie, be treated as confidential. Any such obligation of confidence would arise primarily by dint of the confidentiality of process, rather than the confidential nature of the information that was provided (albeit that this confidentiality nevertheless remains important). The Defendant has admitted in its Defence that the Proposed Disclosure includes documents that have the necessary quality of confidence. (b). Was the information communicated in circumstances importing an obligation of confidence?

[88]The Defendant has admitted in its Defence that this element is satisfied. It accepts that it is under a duty of confidentiality, but it contends that it is outweighed by other considerations. (c). Is the Defendant threatening to use the confidential information to the detriment of the Claimant?

[89]It is common ground that, absent an injunction being granted, the Defendant intends to make the Proposed Disclosure.

[90]I accept, at this stage, the Claimant has shown that he is likely to succeed in demonstrating some element of detriment to him by the Proposed Disclosure. I will consider below whether the fact that a significant element of the detriment relied upon by the Claimant is reputation harm makes any difference to the outcome of the injunction application. (d). Is there a countervailing justification for the disclosure?

[91]This is the central matter of dispute. It must be resolved by balancing the competing interests; whether the confidentiality is outweighed by other considerations. This requires an assessment of the nature and extent of the interference that the Proposed Disclosure would represent to the confidentiality/privacy interests of the Claimant measured against the countervailing interests of the Defendant (and the people to whom the disclosure would be made) in the Proposed Disclosure.

[92]The assessment of the nature and extent of the Claimant’s engaged interests is hampered by the fact that the Claimant has not, in his statement of case, evidence or submissions, identified or analysed the detail of what information in the two documents he alleges is subject to the alleged duty of confidence or disclosure of which would amount to a misuse of private information. He has identified broad categories of information. His case – effectively admitted by the Defendant – is that the investigation process is subject to broad obligations of confidence and, as such, he can therefore object to the Proposed Disclosure. This is rather broad brush. The point has not been the subject of any analysis in the evidence, or detailed submissions, but it can hardly be doubted that at least some of the information in the Proposed Disclosure is not information over which the Claimant could assert any obligation of confidence, for example information relating to various patients. The Claimant has not sought to identify any particular information in the Proposed Disclosure which he contends is especially sensitive. The application seeks to prohibit the Defendant from making the Proposed Disclosure, in toto.

[93]An MHPS investigation will usually and necessarily be conducted with a degree of confidentiality. That will be so not only to protect the subject of the investigation, but also others, particularly any patients. However, the investigation may uncover matters that may need to be reported to other bodies, for example regulators and even the police. In such instances, it cannot sensibly be argued that such disclosures are prohibited either by a contractual duty of confidence or an equitable obligation of confidence. The MHPS regime expressly recognises that such disclosures may need to be made. I accept Mr Hyam KC’s submission that any contractual term that did purport to limit such necessary disclosures would be vulnerable to being held void as contrary to public policy or being overridden in the public interest. The same analysis leads me to conclude that the principle that enhanced weight in cases where there is an express contractual obligation of confidence (see [39] above) has little or no impact on the result in this case. Even if the Claimant were to succeed in demonstrating, at trial, that MHPS confidentiality restrictions had been incorporated into his employment contract, he recognises that such restrictions cannot be absolute.

[94]I accept that the Proposed Disclosure will include details of: i) the nature of the work undertaken by the Claimant in his clinical practice; ii) the investigations into the Claimant; iii) the conclusions of those investigations, including findings or opinions that are adverse and potentially damaging to the Claimant; and iv) the Claimant’s responses to the findings/allegations.

[95]Balanced against that, the Proposed Disclosure is to a limited group of individuals, all of whom, by reason of being former patients of the Claimant, have a direct and legitimate interest in receiving the Proposed Disclosure. Those in Cohort 1 and 2 are either individual claimants whose cases and circumstances have already been reviewed (Cohort 1) or in respect of whom there are likely to be issues concerning informed consent (Cohort 2). This is a very limited category. The Defendant is not proposing disclosure to the world at large. Mr Cheetham KC expressed concern on behalf of the Claimant that once the Proposed Disclosure has been made, there will be nothing to prevent wider dissemination of the documents or their contents. In my judgment, there are two points in answer to that concern: i) First, the Defendant has made clear that it will make the Proposed Disclosure on express basis that the documents are to be used solely for the purposes of the civil claim (see [23] above). I accept that this is not a legally enforceable restriction, but equally, the Claimant has no evidence to suggest that the professional advisers of the claimants to whom the Proposed Disclosure will be made would disregard it. Those advisors will also be practically bound to explain to the claimants the use that they can make of the documents and the legal restrictions that might apply to wider dissemination of them. ii) Second, even if a person to whom the Proposed Disclosure was made threatened to, or did, disclose the documents to third parties, the Claimant would have recourse to potential civil remedies arising from further disclosure/publication. I say nothing more about that. The Court would have to adjudicate on any such matters as and when they arose. The short point is that the fear that there might be onward transmission of the Proposed Disclosure is not a sufficient reason to prevent the Proposed Disclosure.

[96]The Claimant’s strongest argument was that the Proposed Disclosure is not necessary at this time. In summary, it is not until the actual or threatened civil claims have reached the point at which disclosure is considered that any determination can properly be made as to whether the MHPS outcome letter and Document X should be disclosed. There is force in Mr Cheetham KC’s submission that if, in any claim, the Defendant had admitted liability, it is difficult to see how these documents would fall within standard disclosure. Such an approach would not only have the benefit of ensuring that any disclosure is carried out in a fact specific way in each claim, but also that any disclosure would also be subject to the usual restrictions on collateral use of the documents (see CPR 31.22).

[97]In my judgment, however, this is to take too narrow a view as to the justification for the Proposed Disclosure. What a Court would order, by way of disclosure in civil proceedings – whether as standard disclosure under CPR 31.6 or pre-action disclosure under CPR 31.16 – is not the limit of what can lawfully be disclosed by the Defendant. Looked at purely within the confines of litigation, a party in civil proceedings is always free to disclose more to an opponent than a Court would order. There may be good reasons why a litigant might want to give disclosure going beyond his/her strict obligation under Part 31. In this case, the Defendant considers that it has an obligation to disclose the documents arising from the agreed ADR process and under the pre-action protocol. It wishes to do so, as explained in the Defendant’s evidence, because it wants to resolve any claims as quickly (and inexpensively) as possible. Ms Slingo has deposed in her witness statement that the Proposed Disclosure is “essential” in order to comply with the pre-action protocol. This conclusion has not been substantially challenged by the Claimant, and in the circumstances of this case, I have no difficulty in accepting it. It is irrelevant to this point that the documents in the Proposed Disclosure are not “clinical records” (see [79] above). It is quintessentially a matter of judgment for the Defendant to determine whether the Proposed Disclosure is necessary in the context of the litigation it faces. As the evidence shows, there has been widespread concern about the activities of the Claimant, which has already been subject of media coverage (see [7]-[10] in the First Judgment). A large number of claims have been threatened. The firms representing actual or potential claimants are well aware of the MHPS investigation, some even know of the existence of Document X and have specifically requested disclosure of it. Mr Hyam KC stated in argument that some firms representing potential claimants have adopted a stance that, until proper disclosure is made, then they will not enter settlement discussions. Again, that is not surprising. It is unlikely that a firm acting for potential claimants would agree a final settlement without seeing the Proposed Disclosure.

[98]For these reasons, I accept that the Defendant does have weighty and legitimate reasons for making the Proposed Disclosure. I do not accept the Claimant’s submission that the justification for disclosure is weakened by the absence of current patient safety issues or the fact that a report has been made to the GMC. In my judgment, the Defendant is likely to succeed in demonstrating that it has the right to make the Proposed Disclosure (applying the principles from Tournier – see [41] above).That is so simply looked at in the context of the threatened or actual litigation. But it goes further than that. Although not something advanced in Ms Slingo’s witness statement, I accept Mr Hyam KC’s submission that the Defendant’s wider Duty of Candour has a significant bearing on the Proposed Disclosure that is quite separate from the needs of the litigation. There is no doubt that candour and openness underpin the ADR regime and the ethos of the pre-action protocol, but that is litigation specific. Even if no litigation had been threatened, the Defendant would still be under the Duty of Candour imposed by Regulation 20 (see [42] above). Quite apart from this specific legal duty, the Defendant could readily (and reasonably) conclude that it was obliged to tell former patients of the Claimant about concerns that had been raised about his practice, the investigations that had been undertaken and the conclusions that had been reached (and the basis for them). It is for the Defendant to decide what should be disclosed and to whom pursuant to this Duty of Candour and/or any wider obligation that the Defendant feels that it is under.

[99]This is not a public law challenge, but I should have been inclined to accept Mr Hyam KC’s submission that the standard for review of a decision to disclose under the Duty of Candour would be Wednesbury unreasonableness. In this private law case, it is for the Claimant to demonstrate that he is likely to show at trial the Proposed Disclosure should not be allowed. In my judgment the Claimant is not likely to succeed in doing so. He is not likely to demonstrate that the Proposed Disclosure would involve unconscientious use of any confidential information of the Claimant.

[100]On the contrary, I think it is likely that the Defendant would establish at trial that it is under a duty to make the Proposed Disclosure, including such confidential information relating to the Claimant that it contains. The interference with the confidentiality interests of the Claimant in the Proposed Disclosure, although significant, arises in the context of disclosure only to a limited number of identified individuals all of whom have a clear and significant interest in receiving the Proposed Disclosure. As such, and without difficulty, I reach the conclusion that these confidentiality interests are likely to be outweighed by the Defendant’s obligation (and interest) in the Proposed Disclosure. The public interest in disclosure is significant and is reflected in, and reinforced by, the Duty of Candour. A prohibition on the Proposed Disclosure would be a significant and direct interference not only with the Defendant’s ability to comply with the Duty of Candour but also its wider interests of acting appropriately and responsibly in the discharge of what it believes to be its obligations to former patients whom it believes may have suffered harm because of the actions of the Claimant. (2). Misuse of private information

[101]The failure of the Claimant to particularise the private information in the Proposed Disclosure in respect of which he claims to have a reasonable expectation of privacy is a more serious issue in respect of the misuse of private information claim. That is because the question whether a person can have a reasonable expectation of privacy in information is more nuanced than simply whether it is confidential (see [15] above).

[102]The Claimant contends, simply, that the information contained in the Proposed Disclosure is private (see [13] above). As a bald proposition, that must be rejected. Only some of the information in the Proposed Disclosure is information in respect of which he could have a reasonable expectation of privacy. The contention that the Claimant’s conduct whilst at work and the disciplinary action taken in respect of him relate to his private life is not straightforward either. The extent to which a person’s Article 8 rights are engaged in a work setting can be a complicated question. In particular, a claim that the Claimant has a reasonable expectation of privacy in his treatment of patients would appear to be ambitious.

[103]Neither party made submissions on this potentially difficult issue, so it would not be right for me to make any decision on it at this stage. I will assume, for the purposes of this judgment, that the Claimant is likely to succeed in demonstrating that he has an expectation of privacy in respect of at least some of the information in the Proposed Disclosure. The reason I am prepared to make that assumption is that I am quite satisfied that, for the same reasons that I have set out and analysed in relation to the claim of breach of confidence, any such privacy interests that the Claimant could establish are likely comfortably to be outweighed by the countervailing interests of the Defendant in making, and the former patients receiving, the Proposed Disclosure. (3). Data Protection

[104]I am not persuaded that Mr Cheetham KC’s analysis of the data protection legislation is correct. His analysis of the requirements of Article 5 may be right, but importantly these must be read together with the provisions of Article 6. In my judgment, Mr Cheetham KC’s contention that processing in accordance with a legal obligation must be given a narrow construction is not correct. Recital 45 notes that the relevant legal obligation for processing should have a basis in domestic law. The data protection legislation must be read purposively not mechanically. It does not give a data subject a ‘veto’ on what data can be disclosed. Consent is only one of the bases on which data can be processed lawfully. Finally, the examples of lawful processing in s.8 Data Protection Act 2018 are not exhaustive.

[105]In my judgment, it is likely that the Defendant will succeed in demonstrating that the Proposed Disclosure is lawful under Article 6(1)(c) and/or (e). The clearest legal obligation is the Duty of Candour, but I would accept that the Defendant is also likely to establish that a sufficient duty also arises under the pre-action protocol. I do not accept that the purpose for which the data were originally collected excludes the further processing that is involved in the Proposed Disclosure. It is expressly recognised – and therefore accepted – that any MHPS process, once completed, may give rise to a need for further disclosure. To the extent necessary, I am also persuaded that the Defendant is likely to establish that the Proposed Disclosure falls within the exemption provided in Schedule 2, Paragraph 5(3) of the Data Protection Act 2018. The Proposed Disclosure is disclosure, including data relating to the Claimant, which is necessary in connection with prospective legal proceedings and/or is otherwise necessary for the purposes of establishing, exercising or defending the legal rights of the claimants in the relevant Cohorts to which the Proposed Disclosure is to be made.

[106]Finally, insofar as the Claimant’s data protection challenge is made on the basis of the alleged inaccuracy of the data, I do not consider that the Claimant is likely to succeed. Under the legislation, data are inaccurate if they are incorrect or misleading as to any matter of fact: s.205(1) Data Protection Act 2018 Act. Under Article 5(1)(d), personal data are required to be accurate “having regard to the purposes for which they are processed”. Some records, which contain personal data, must be maintained, intact, because of the nature of the record, notwithstanding that the data may subsequently be shown to be inaccurate (e.g. police records, see discussion in AB -v- Chief Constable of British Transport Police

[2022] EWHC 2749 (KB)

). Arguably, the MHPS outcome letter falls into this category. It represents the findings made in respect of the Claimant following the MHPS investigation. It is a combination of statements of fact and conclusions (or expressions of opinion). The Claimant cannot, by an accuracy challenge under data protection legislation, seek the amendment or rectification of the factual findings in the MHPS outcome letter. He may have other remedies in respect of any alleged inaccuracy, and he may have objections to some forms of processing, but the nature of the document (and the reasons for which it is retained) must properly be recognised when considering the data protection claim. (4). Conclusion

[107]For these reasons, I am wholly unpersuaded that the Claimant has demonstrated that he is likely to demonstrate that the Proposed Disclosure should not be allowed on any of the legal bases advanced. In short, he has failed to meet the threshold requirement imposed by s.12.

[108]Having reached that conclusion, it is not necessary for me to consider whether the ‘nub’ of the Claimant’s claim for an interim injunction was to protect his reputational interests, such as to require him to demonstrate that his claim was ‘bound to succeed’ (see [62] above). Equally, it is not necessary for me to decide whether, had the s.12 threshold been cleared, I would have refused relief on the grounds of the alleged misconduct of the Claimant (see [82] above). However, in my judgment, it would have been impossible, at this interim stage and on the basis of the evidence I have, to conclude that the Claimant was guilty of such ‘misconduct’ that he should be refused an interim remedy to which he had otherwise demonstrated an entitlement.

[109]I have decided the injunction application on the basis that the Claimant has failed to demonstrate that his claim is likely to succeed. Even had I concluded in his favour on this point, I would nevertheless have refused to grant an injunction, as a matter of discretion, on the grounds that the Claimant has an adequate remedy in damages. This is not the typical case of breach of confidence/breach of privacy, where a claimant can point to a specific piece of information, the disclosure of which he seeks to prevent. In such cases, damages may well not be an adequate remedy because once the information has been published the confidentiality is lost forever. Such cases also allow a much clearer analysis of whether a claimant is likely to show that the publication should not be allowed. However, this is far from the paradigm case. The Proposed Disclosure is a complicated synthesis of material only part of which could the Claimant maintain a breach of confidence claim and the proposed disclosure is limited. For the reasons I have set out, I am sceptical that he will succeed with any separate claim for misuse of private information and, in respect of the data protection claim, I am satisfied that damages would in any event be an adequate remedy should the Claimant subsequently succeed in a claim on this basis.

order

i) is no answer to the Defendant’s Duty of Candour, which is entirely separate from any claims that the Defendant may face; ii) is contrary the spirit, if not the terms, of the pre-action protocol and the ‘cards-on-the-table’ approach to modern litigation; and iii) is likely to cause delay and to undermine the Defendant’s efforts to resolve potential Cohort claims through the ADR protocol and without the need for litigation or applications to the Court (4). Interim Injunction