In June, the U.K. Court of Appeal reversed an English High Court decision and permitted General Medical Council, as data controller, to disclose an expert medical report to a patient pursuant to a data subject access request. The case involved a patient request for personal health care data that was "inextricably mixed" with the personal data of the doctor and weighed the privacy rights of the doctor against the access rights of the patient under the U.K. Data Protection Act 1998, which has since been replaced. Marc Stauch writes for Privacy Tracker about the case, which is "the leading U.K. judgment on how DSARs should be resolved in ‘mixed data’ cases," noting, "the same approach will apply to consideration of such cases under the U.K.’s new Data Protection Act 2018."
Full Story