Giovanni Marcheselli v The Information Commissioner & Anor [2023] UKFTT 76 (GRC)

Case Reference: EA/2020/0335[2023] UKFTT 00076 (GRC)
First-tier Tribunal
General Regulatory Chamber
Hearing Heard on: 5 August 2021Date 4 October 2022
Information Rights
Heard: Paper determination
Promulgated on: 25 January 2023
Before
TRIBUNAL JUDGE LYNN GRIFFINTRIBUNAL MEMBER ANNE CHAFERTRIBUNAL MEMBER ALISON LOWTON
Between
GIOVANNI MARCHESELLIAppellantTHE INFORMATION COMMISSIONERRespondentTHE GENERAL MEDICAL COUNCILRespondentDecision: The appeal is DismissedREASONS

The factual background to the appeal

[1]In September 2019 the appellant raised his concern with the General Medical Council (GMC) about the fitness to practise of a doctor alleging that he and his family had been harmed by the doctor’s actions which he said had brought the profession into disrepute. In November 2019 he raised further allegations with the GMC about a second doctor. The GMC decided not to open an investigation into the issues raised by the appellant about either doctor. Those decisions were notified to him on 9 December 2019 and the appellant requested a review of the GMC’s decisions on 23 December 2019 which was referred to the GMC’s review team in accordance with the GMC Rules. In due it was determined after review that a fresh decision was not necessary and the original decision to close the matter would stand. This decision is not about resolving those allegations which were considered by the GMC and responded to within their responsibility as the regulator of medical practitioners in the UK. Nor is this decision about the appellant’s dissatisfaction with the GMC’s decision and its fitness to practise processes or the general system of regulating doctors.[2]On 23 February 2020 the appellant wrote to the GMC to request information under the Freedom of Information Act 2000 (FOIA). This decision is only about that request and whether the information requested by the appellant should be disclosed to him.[3]The information requested concerned one of the doctors about whom the appellant had complained in September 2019, that doctor is not named in this decision, which will indicate where their name would have been in any quoted material 1. See order made under rule 14 at the end of this decision . The information request read as follows “Information request RE: [name and GMC no of Dr redacted] Please provide the following information in respect of this doctor which is not on the medical register: 1. Names of Designated body and / or Annual Appraisal Doctor / Responsible officer for last five years: 2019, 2018, 2017, 2016, 2015 2. Year or date of last revalidation 3. Year or date of next revalidation General queries: Can a doctor acquire practising privileges at a designated body (non NHS) and then not actually work there but run his/her own private practice instead? Would this be regarded as having a 'connection'? Would the designated body where there are only practising privileges but not any employment or contracts be regarded as having an appropriate connection for appraisal and/or revalidation requirements? Under what circumstances might a psychiatrist have a responsible officer who is not also a psychiatrist?” Please provide the following information in respect of this doctor which is not on the medical register: officer for last five years: 2019, 2018, 2017, 2016, 2015 General queries: Can a doctor acquire practising privileges at a designated body (non NHS) and then not actually work there but run his/her own private practice instead? Would this be regarded as having a 'connection'? Would the designated body where there are only practising privileges but not any employment or contracts be regarded as having an appropriate connection for appraisal and/or revalidation requirements? Under what circumstances might a psychiatrist have a responsible officer who is not also a psychiatrist?”

Under what circumstances might a psychiatrist have a responsible officer who is not

[4]The GMC response was sent on 24 March 2020. As regards questions 1 – 3 in the request the GMC told the appellant that they were withholding the requested information under section 40(2) FOIA as it was the doctor’s personal data. The GMC went on to give an explanation as regards the appellant’s general queries. The GMC asked the appellant to clarify his queries as they indicated that the questions may be based on misunderstandings. Those general queries were the subject of further correspondence but do not form part of this appeal which is concerned with the information requested in questions 1-3.[5]Revalidation as referred to in questions 2 and 3 of the request, is the process by which the GMC confirms the continuation of a doctor’s licence to practise in the UK. Revalidation is mandatory for doctors who wish to retain their licence to practise. Revalidation involves a yearly appraisal process which will often involve a “Designated Body” and a “Responsible Officer”. A Designated Body is an organisation that assists a doctor with their appraisal and revalidation process; the Responsible Officer at the relevant Designated Body makes the recommendation for the revalidation. If a doctor has a Responsible Officer, they will make a revalidation recommendation to the GMC every five years. Revalidation can also be undertaken in alternative ways, for example through the GMC’s approval process, or via an alternative “suitable person”. Although a doctor may work in more than one place at a given time a doctor can only be attached to one Designated Body at a given time. This does not necessarily indicate that their Designated Body is their sole employer, or their employer at all. It does not even necessarily indicate their physical place of work: for example, many locum agencies are Designated Bodies. Where a doctor has multiple employers, their Designated Body is determined by application of the Medical Profession (Responsible Officer) Regulations 2010 (“the 2010 Regulations”).[6]The appellant wrote back to the GMC on 2 April 2020 disputing that the information requested in questions 2 and 3 of the request would be personal data and stated that as the information within question 1 had been in the public domain previously the GMC were wrong to rely on s40(2) in that regard.[7]The GMC not only publishes guidance about the revalidation process but also publishes specific categories of information about doctors and their registrations in the Medical Register which is available to the public on the GMC’s website. There is a publication policy which sets out what information will be published about each registered doctor, this includes the current status of their licence to practise, confirmation of whether they are subject to revalidation, and if so their current Designated Body and Responsible Officer.[8]The GMC does not publish information once it is no longer current. Thus at the time of the request on 23 February 2020 the information requested in question one of the request was not published.[9]The GMC has never published the year or dates of doctors’ revalidations as sought in parts 2-3 of the request, nor has it published the names of appraisers other than Responsible Officers as it sees no need to do so, as the publication of such details about a doctor’s career would not assist the public in understanding or scrutinising either the GMC’s discharge of its regulatory functions or the doctor’s fitness to practise and historic data may only provide a partial picture of the doctor’s recent career history. The GMC has a process for handling complaints and comprehensive fitness to practise procedures that operate within a statutory framework but the information requested by the appellant is not relevant to that regime as the public does not need such information should they wish to make a complaint about a doctor or to understand the GMC’s discharge of its statutory function.[10]The GMC publishes specific categories of information about doctors and their registrations in the Medical Register, available on the GMC’s website. Those categories of information have been selected by the GMC in order to strike the correct and proportionate balance between transparency in respect of doctors’ registrations (and thus this aspect of the GMC’s regulatory functions) and doctors’ rights to privacy. The GMC’s approach is detailed in its Publication and Disclosure Policy. That policy is intended to inform doctors’ reasonable expectations as to what information about them will and will not be made publicly available. That policy was amended in 2016, following a consultation exercise, which was also published. The decision notice in this case[11]The appellant requested an internal review on 8 April 2020 noting that the GMC position was that information that is no longer current reacquires a private status but that in his view this was contrary to the revalidation processes’ stated aims of ensuring that doctors are “safe” to practise and reduces transparency.[12]The result of the internal review was notified to the appellant on 1 July 2020. The GMC maintained its original position that the information requested is the personal data of the named doctor.[13]The appellant complained to the Information Commissioner on 21 July 2020. Having conducted an initial review the Commissioner indicated that it was the Commissioner’s initial assessment that the exemption provided by s40(2) was properly engaged and invited the appellant to withdraw his complaint. However, he did not withdraw the complaint and requested a formal decision notice which was issued on 26 October 2020, reference IC-47549-W6H0.

Legal Framework

(a) Legal Framework

[14]Section 1 FOIA sets out the duty on a public authority to communicate information requested of it as follows “(1) Any person making a request for information to a public authority is entitled—(a) to be informed in writing by the public authority whether it holds information of the description specified in the request, and(b) if that is the case, to have that information communicated to him.” It is to be noted that disclosure made pursuant to s1 FOIA is regarded as made to the world at large and not simply to the requestor. (a) to be informed in writing by the public authority whether it holds information of the description specified in the request, and (b) if that is the case, to have that information communicated to him.” It is to be noted that disclosure made pursuant to s1 FOIA is regarded as made to the world at large and not simply to the requestor.[15]However, the duty in section 1 does not apply to “exempt information” by virtue of section 2:
“(2) In respect of any information which is exempt information by virtue of any provision of Part II, section 1(1)(b) does not apply if or to the extent that— (a) the information is exempt information by virtue of a provision conferring absolute exemption, or (b) in all the circumstances of the case, the public interest in maintaining the exemption outweighs the public interest in disclosing the information. (3) For the purposes of this section, the following provisions of Part II (and no others) are to be regarded as conferring absolute exemption— … (fa) section 40(2) so far as relating to cases where the first condition referred to in that subsection is satisfied,” (a) the information is exempt information by virtue of a provision conferring absolute exemption, or (b) in all the circumstances of the case, the public interest in maintaining the exemption outweighs the public interest in disclosing the information. (fa) section 40(2) so far as relating to cases where the first condition referred to in that subsection is satisfied,”
[16]In this case the relevant provision conferring an exemption in Part II of FOIA is section 40 This is the relevant version of this provision applicable to the decision notice but which has since been amended upon the end of the ‘Brexit’ transition period. which at the time of the request stated as relevant “(2) Any information to which a request for information relates is also exempt information if—(a) it constitutes personal data which does not fall within subsection (1), and(b) the first, second or third condition below is satisfied. (3A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act— (a) would contravene any of the data protection principles, … (3B) The second condition is that the disclosure of the information to a member of the public otherwise than under this Act would contravene Article 21 of the GDPR (general processing: right to object to processing). (4A) The third condition is that— (a) on a request under Article 15(1) of the GDPR (general processing: right of access by the data subject) for access to personal data, the information would be withheld in reliance on provision made by or under section 15, 16 or 26 of, or Schedule 2, 3 or 4 to, the Data Protection Act 2018, or (b) on a request under section 45(1)(b) of that Act (law enforcement processing: right of access by the data subject), the information would be withheld in reliance on subsection (4) of that section.” (a) it constitutes personal data which does not fall within subsection (1), and (b) the first, second or third condition below is satisfied. (a) would contravene any of the data protection principles, … (a) on a request under Article 15(1) of the GDPR (general processing: right of access by the data subject) for access to personal data, the information would be withheld in reliance on provision made by or under section 15, 16 or 26 of, or Schedule 2, 3 or 4 to, the Data Protection Act 2018, or (b) on a request under section 45(1)(b) of that Act (law enforcement processing: right of access by the data subject), the information would be withheld in reliance on subsection (4) of that section.”[17]Personal data is defined in the Data Protection Act 2018 within s3(2) which reads ““Personal data” means any information relating to an identified or identifiable living individual”[18]The first data protection principle is set out in Article 5(1)(a) of the GDPR, as follows “Personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject.”[19]“Fairness” entails balancing the reasonable expectations of the data subject and the damage or distress that disclosure is likely to cause against any countervailing justification for disclosure.[20]In order for processing to be lawful, one of the reasons listed in Article 6(1) of the GDPR must apply to the processing. The only basis that is potentially applicable in this case is Article 6(1)(f), which sets out that “..processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data…”[21]There is a three-part test that must be satisfied if Article 6(1)(f) is to be regarded as the lawful basis for processing the data. That three part test is as followsa. Legitimate interest test: whether a legitimate interest is being pursued in the request for information;b. Necessity test: whether disclosure of the information is necessary to meet the legitimate interest in question;c. Balancing test: whether the above interests override the legitimate interest(s) or fundamental rights and freedoms of the data subject.[22]Guidance has been given in caselaw as to the approach that is to be taken to the application of the three part test and although that arose under a previous provision that is equivalent to Article 6(1)(f), and thus the rulings of the Upper Tribunal remain relevant and binding on the First Tier Tribunal.[23]The primary case to be considered is Goldsmith International Business School v Information Commissioner and Home Office [2014] UKUT 563 (AAC). A “reasonable expectation of privacy” is central to the engagement of an individual’s rights under Article 8 of the European Convention on Human Rights (“ECHR”). The analysis of fairness and of condition 6(1)(f) will therefore be applied in accordance with ECHR principles of proportionality meaning that disclosure can only take place if it would be reasonably necessary for the purposes of a “pressing social need” and it must be the least intrusive way of achieving that aim.[24]We were also referred the decision of the Upper Tribunal in Information Commissioner v Rodriguez-Noza and Foster [2015] UKUT 449 (AAC) which applied the dicta of the courts and states “The first stage is to consider whether the processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data would be disclosed. If not, it is not necessary to proceed to the other stages. That is what I decided in Farrand at [29]. The second stage only arises if the consideration passes the first stage. It is then necessary to identify the rights and freedoms or legitimate interests of the data subject. If there are none, it is not necessary to proceed to the third stage. The third stage only arises if the consideration passes the first and second stages. It is then necessary to consider whether the processing is unwarranted, or overridden, in any particular case by reason of prejudice to the data subject’s rights, freedoms or legitimate interests.”[25]In DB v GMC [2018] EWCA Civ 14978, the Court of Appeal confirmed that data controllers are best placed to make decisions about how that balance should be struck in their particular context. That is not to say that the Tribunal is bound by the decision of the data controller but that weight to the GMC’s assessment of how the balance is struck and a good reason would be needed to overturn that assessment as regards the disclosure of personal data. The appeal and the submissions of the parties[26]The appellant lodged his notice of appeal against the decision notice on 20 November 2020. The remedy sought by the appellant was the disclosure of the requested information.[27]The appellant requested a paper determination of his appeal and no other party requested an oral hearing. Given the issues and receipt of written submissions from all three parties that set out and developed their respective cases and response to each others points, we decided it was fair and just to determine the appeal on the papers.[28]The grounds of appeal run to just over 4 pages and was accurately summarised as follows by the first respondent in their response into four key points “1) When assessing the legitimate interests element, the DN erroneously discounts information on the basis that it refers to a ‘second doctor’. The Appellant explains that there is only one doctor at issue, which is the named doctor. 2) When considering the necessity element, allowing the revalidation history of the named doctor to be withheld means that the revalidation history of all doctors could be withheld. This means that the Appellant’s “more general concerns cannot ever be addressed”. The Appellant’s view is that this information should be available in respect of all doctors. 3) In respect of the necessity element, the public needs to have access to doctors’ history of connection to various Designated Bodies and Responsible Officers because this can reveal safety issues. In addition, the Appellant’s experience shows that the entries in the publicly available information may be inaccurate. 4) When considering the balance of interests test, the Commissioner incorrectly records the detail of some of the Medical Profession (Responsible Officer) Regulations 2010. In addition, Sir Keith Pearson has provided a review that highlights some weaknesses in the current revalidation process. All of this indicates that a doctor’s connection and disconnection history is a matter of public concern. The public needs this information in order to have confidence in the system. Disclosure of this information will add to patient safety. Any distress to the doctor would be outweighed by these matters”[29]The Information Commissioner responded to the appeal on 20 January 2021. The Commissioner invited the tribunal to uphold the decision notice and dismiss the appeal. From the response and later written submissions the case for the Information Commissioner and their core submissions can be summarised as followsa. The information at issue is personal data.b. The data protection principle in Article 5(1)(a) would be contravened by the disclosure: the processing would not be lawful, fair and transparent. This is because there is no lawful basis in Article 6(1) GDPR for this processing. Thus the exemption in s.40(2) FOIA is applicable as the condition in s.40(3A) applies.c. In applying the three stage test only the first element is satisfied. The Commissioner accepts that there are legitimate interests in transparency, concerns about the doctor’s safety and concerns about the GMC’s revalidation process.d. Disclosure is not necessary because all of those interests can be addressed by the information already in the public domain (namely, the doctor’s current licence to practise, revalidation status and relevant Designated Body, as well as information from the GMC on how it manages revalidations).e. When balancing the competing interests, disclosure would do little to advance the legitimate interests at issue; the information is formulaic and procedural and does not contain any detail on the named doctor’s safety to practise or experience. On the other side of the balance, disclosure could be distressing to the named doctor and, either way, it would undermine their reasonable expectation that this (ordinarily non-public) information would not be disclosed under FOIA.[30]Having been joined to the proceedings by the Registrar on 23 December 2020, the GMC responded to the appeal in a document served on 3 February 2021. The case for the GMC as set out in their response and later submissions can be summarised as followsa. The information requested is personal data within the statutory definition.b. The public disclosure of the doctor’s personal data under FOIA would contravene Article 5(1)(a) GDPR in that it would be unfair and unlawful. it would not be in accordance with Article 6(1)(f) GDPR or with any other lawful processing condition. The GMC agrees with and adopts the Information Commissioner’s position as set out in the decision notice.c. Doctors reasonably expect that the GMC will consider any complaints it receives about them in accordance with the fitness to practise regime which is the appropriate mechanism for investigations into a doctor’s fitness to practise Based on the GMC’s Publication and Disclosure Policy and its established practice, the doctor about whom the information is sought would have had a reasonable expectation of privacy in respect of the information about them that fell within the terms of the request.d. Generally, doctors would not expect, and are liable to be concerned and upset by, disclosures of personal data about them made by the GMC contrary to its own publication and disclosure policies, and/or that facilitate independent private lines of inquiry by aggrieved patients who do not accept the GMC’s decisions in respect of their complaints.e. The information requested in question 1 had been published while it was current, but that did not strip the doctor of their privacy rights once that information was historic and no longer publishedf. The information requested in questions 2 and 3 has never been published and thus fell within the doctor’s reasonable expectation of privacy.g. The materials in the bundle about that consultation are evidence that the GMC’s approach to publication is the product of careful thought and analysis, informed by detailed consultation, aimed at striking the right balance between transparency and privacy interests. The Tribunal should give significant weight to the GMC’s approach to the striking of that balance, which draws on its expertise, experience and careful analysis.h. The GMC has been transparent with the appellant about its decisions and reasoning in their response to his complaint. The appellant’s persistence in his dissatisfaction with what the GMC has explained to him is not a sufficient reason to provide him with additional personal data about the doctor, so as to help him with his personal investigations into the doctor’s background. The appellant’s correspondence and submissions indicate that the appellant wishes to pursue his own investigation into the doctor in order to “assail” the doctor’s competence outside of the statutory fitness to practise regime.i. The prejudicial consequences for he doctor could in principle be outweighed if there were an adequate justification for the public disclosure of this data However, the public disclosure of this information about the doctor would not further any legitimate objective at all, or to any sufficient extent. It would be unfair to the doctor to publish information about his career that he reasonably understood would not be published.[31]In his reply and later submissions the appellant added to his submissions in his grounds of appeal. We have read and considered all the submissions he has made even if not specifically referred to in this document as they run to many pages. This is a summary of the relevant submissions to the central issues in the casea. There is no issue about the legal principles to be applied but he does not accept that the information requested is personal data within the meaning of the statute.b. He has taken steps not to disclose the name of the doctor or the details of “injuries suffered” in the presentation of his appeal. The manner of the conduct of his investigations is not of relevance to the application of the legal principles. It is not correct to say that he wishes to “assail” the doctor and the GMC are wrong to impute motives to his actions. His concern is solely for the well being of others.c. There is a public interest in ensuring that regulatory compliance is taking place. Refusal to disclose the information is contrary to this public interest as it frustrates the ability of patients to ask questions.d. The decision of the GMC on whether to communicate the information requested should not be given any weight as the decision they took as data controller is contrary to their stated aim of protecting the public and any deference to the decision of the regulator would reduce accountability.e. Doctors should have no greater expectation of privacy than other professionals and if the GMC has led their registrants to believe they have greater levels of privacy than normal by their policies that does not affect the legal position which should be as for everyone else.f. Because there is a legal requirement for revalidation, the information in the form of dates in that regard does not amount to personal data and there is no expectation of privacy in relation to them or any likelihood of damage or distress.g. It is not practical to monitor the GMC website for real time changes in data about a doctor

Analysis

[32]When a person requests information from a public authority there is a duty on that authority under section 1(1) FOIA to communicate that information to the requestor (and thereby to the world) unless it is exempt information within the other provisions of that act. The possible exemption at issue in this case is the application of section 40 which concerns personal data. Personal data is defined as any information relating to an identified or identifiable living individual.[33]The request asked for the named doctor’s designated body, annual appraisal doctor, responsible officer from 2015-19 and the dates of his revalidation. We have concluded that all of the information requested by the appellant in the three questions that made up his request is personal data. That is because it relates to a living individual and when coupled with other information (in this case, the terms of the Request) that individual is clearly identifiable from and in relation to it. It does not matter for these purposes that the information is “procedural or formulaic” because it relates to the named doctor in the way required by the legislation.[34]We then turned to consider whether the disclosure of the information to the appellant otherwise than under FOIA would contravene any of the data protection principles. In doing so we were focussed on the application of s40(3A)(a), “the first condition”, which was the condition relied upon in the decision notice at issue.[35]By virtue of the first data protection principle set out in Article 5(1)(a) of the GDPR, personal data must be processed lawfully, fairly and transparently in relation to the data subject. The data subject in this case is the named doctor. The processing with which we are concerned is the potential disclosure of that personal data to the appellant, and the public at large.[36]In order to be lawful in the context of this case, Article 6(1)(f) of the GDPR must apply to the processing. We have applied the three part test, each section of which must be satisfied if there is to be a lawful basis for the processing. That three part test is as followsa. Legitimate interest test: whether a legitimate interest is being pursued in the request for information;b. Necessity test: whether disclosure of the information is necessary to meet the legitimate interest in question;c. Balancing test: whether the above interests override the legitimate interest(s) or fundamental rights and freedoms of the data subject.[37]In the application of the three part test we have concluded, as did the Information Commissioner in the decision notice that only the first part of the test is satisfied.[38]We accept that there are legitimate interests in transparency, concerns about the doctor’s safety and concerns about the GMC’s revalidation process. Members of the public, have a legitimate interest in transparency about the GMC’s discharge of its regulatory functions, including oversight of the suitability and fitness to practise of registrant doctors. That is not to say that we have concluded that, in this case, any of those concerns are well founded, as explained above this decision is not concerned with resolving the appellant’s concerns on these issues.[39]We considered the point raised by the appellant that a factual error in the decision notice about a second doctor who the appellant states does not exist. Whether or not there is a second doctor is immaterial to the analysis we have undertaken about the legitimate interests at stake. The nature of those interests is unchanged whether or not there is a second named doctor. There is no dispute in this case about the nature of the legitimate interests that engage the first part of the three part test.[40]However, the processing (disclosure) is not necessary because it would not further any legitimate interest. The appellant’s case is that the registration history of the named doctor would reveal safety issues for patients. He has two arguments first, the pattern of changes between Designated Bodies would reveal safety issues, and second, errors in previous entries would show safety issues. However, the information he requests is procedural and formulaic and at most would reveal only the variety in the doctor’s career which of itself in not capable of properly founding any inference about the safety of their practice. Whether or not a doctor has had a varied career, of itself, says nothing about their fitness to practise, safety or competence. No negative inferences could reasonably be drawn from a doctor changing their Designated Body. Similarly, if there are errors in the information this will reveal nothing about such legitimate interests.Errors in revalidation entries, for example due to a doctor misinterpreting the application of the 2010 Regulations, are not indicative of safety concerns[41]The requested personal data would not further the legitimate interests because there is no connection between the legitimate interests on which the appellant relies and the personal data he seeks. Even if disclosure of this personal data were connected to any such legitimate interests, it would not be reasonably necessary for the furtherance of those interests. Such information would not help individuals explore or take further any concerns they may have about particular doctors, and it would not help them scrutinise the GMC’s discharge of its regulatory functions. Such objectives can be taken forward without the information requested via the external complaints process and the statutory appeals/review processes or indeed the remedy of judicial review. Furthermore the current information about doctors is published which enables the timely making of complaints about practitioners. The disclosure of this personal data would not serve a legitimate interest and thus the necessity test is not satisfied.[42]Even though we have concluded that the second part of the test is not satisfied and this would suffice to dispose of the point we have gone on to consider the third aspect in the event we are in error on that point.[43]The third part of the test requires the balancing of the legitimate interests in the processing against the legitimate interest(s) or fundamental rights and freedoms of the data subject, in this case the named doctor. We have decided that the processing is unwarranted, or overridden, in this case by reason of prejudice to the data subject’s rights, freedoms and legitimate interests. That is becausea. The data subject has a reasonable expectation of privacy which would be undermined by such disclosure i. The information has never been published or was not published at the time of the request and response to that request ii. Disclosure under FOIA would be a departure from the published policy and usual practice of the GMC iii. Disclosure under FOIA is unrestricted as to the use that the information may be put to be the requestor or the world at large iv. Disclosure of this information would mean that the named doctor would be being treated in a different way to other doctorsb. Any disclosure could be distressing to the named doctor and facilitate private investigations more properly conducted by the regulatorc. Issues about whether the revalidation history of all doctors should be made public is not a matter for this tribunal. This appeal is solely about the lawful response to a request made under FOIA and arguments about the adoption of another regulatory system have no relevance. The requested information has no necessary, or clear, connection with safety. It is too remote from any issues relating to a doctor’s fitness to practice or to the effective discharge of the GMC’s revalidation and other regulatory functions. The disclosure of the information would advance the legitimate interests of the appellant by at most a minimal degree.[44]To the extent there is a need to consider the named doctor’s rights under Article 8 ECHR we have concluded that the disclosure of this data would be unlawful becausea. The doctor reasonably expected the GMC to keep the information privateb. Its public disclosure would be liable to cause upsetc. No “pressing social need” would be furthered by that disclosure,d. Public disclosure would be unnecessary and disproportionate.[45]We considered whether there was a distinction to be drawn between the information requested in question 1 that had previously been published and that requested in parts 2 and 3 which had never been published by the GMC. We noted that at the time of the request none of the information was published and thus it could be argued that the distinction proposed is illusory. However, we do not find it necessary to determine that point given that we have accepted and give weight to the carefully considered GMC policy decision, as the statutory regulator, that the protection of the public does not require the publication of historic data but only current data. The data is lawfully processed by being held in order to facilitate the GMC’s regulatory function in case of any future complaint. Processing by way of disclosure of any of the information sought is not necessary to protect the public nor allow performance of the regulatory functions of the GMC.[46]As neither the second or third part of the three part test is satisfied the processing of the named doctor’s personal data by disclosure as requested under FOIA would not be lawful because none of the reasons listed in Article 6(1) applies to the processing. Thus such processing would contravene the first data protection principle set out in Article 5(1)(a) of the GDPR, (see section 40(3A)(a) FOIA) and therefore it is exempt pursuant to section 40(2) FOIA.[47]We make it clear that for the reasons set out above we have also concluded that the processing would be unfair in relation to the named doctor as data subject. This also amounts to a contravention of the first data protection principle that would engage the exemption. Conclusion[48]The requested information is accordingly exempt under section 40(2) FOIA, because it is the personal data of the named doctor, and its disclosure to the public would be unfair and not justified by reference to any lawful processing condition from Article 6(1) GDPR. The Information Commissioner’s analysis of this case, as set out in her decision notice was not in error of law and contained no wrongful exercise of discretion.[49]For these reasons the appeal is dismissed.[50]Pursuant to rule 14 of the tribunal rules it is ordered that any matter likely to lead members of the public to identify the doctor about whom the complaint was made shall not be disclosed or published to any third party in relation to these proceedings and no person shall be provided with a copy of the open bundle or any other document or correspondence sent to the tribunal in this appeal without the leave of this tribunal, the Upper Tribunal or a court. This is because the open bundle makes reference to the doctor about whom the complaint was made and I am satisfied such disclosure would be likely to cause that person serious harm; and I am satisfied, having regard to the interests of justice, that it is proportionate to give such a direction. Signed Judge Griffin Date: 4 October 2022