ICO rules against disclosure of deceased person's medical records

The Information Commissioner has issued a decision notice confirming that an NHS trust was right to refuse disclosure of a deceased individual's medical records in response to a request made under the Freedom of Information Act 2000 (FOIA). Section 41 of the FOIA provides that public authorities may withhold information if its disclosure would constitute an actionable breach of confidence. The Commissioner decided that it would be unconscionable to disclose a deceased individual's records, especially as disclosure under the FOIA was potentially to the world at large. Such disclosure would also be actionable as a breach of confidence, as the deceased's personal representatives would have standing to bring proceedings. This case is a reminder that information about deceased individuals is not subject to the Data Protection Act 1998, which only covers information about living individuals. This was why the NHS trust had to rely on section 41 of the FOIA rather than section 40.

Case: Epsom & St Helier University Hospitals NHS Trust, Decision notice FS50071069, 23 October 2006; ICO press release, 30 October 2006.

NOTE: On 17 September 2007, the Information Tribunal upheld the ICO's decision (see Information Tribunal rules against disclosure of deceased person's medical records). (Click here for details of PLC IPIT & Communication's policy on annotating case reports.)