People have the right to argue case against disclosure of their sensitive data, rules Scottish court

The Outer House at the Court of Session said that privacy rights provided for under Article 8 of the European Convention on Human Rights (ECHR) would not be properly respected unless people were at least offered the opportunity to oppose the disclosure of sensitive details about them.

"There will not inevitably be a breach of a complainer’s Article 8 rights if an order for recovery of her medical records is made without her having had the opportunity to be heard in opposition to it," Lord Glennie said. "There might be exceptional circumstances justifying that course. But it does not support for the proposition that giving the complainer (or other person whose rights may be affected by the disclosure of the medical records) a right to be heard is generally unnecessary… I consider that intimation to the complainer and the provision of an opportunity to be heard before an order for recovery of her medical records is made is required if there is not to be a breach of the complainer’s Article 8 rights." 

Lord Glennie's judgment came in a case that involves an alleged victim of assault and domestic abuse and her bid to obtain legal aid to help her argue against the disclosure of her medical, psychiatric and psychological records. She wants to prevent her health data from being shared with the alleged perpetrator, who wants access to the information to help his defence against the charges brought against him, according to the ruling.

The alleged victim applied for legal aid to help her argue her case for non-disclosure before the courts, but Scottish Ministers refused the application. They said that the courts would take account of her privacy rights when deciding whether disclosure of her health data was justified and that it was not necessary for her to make her own case for non-disclosure before the court.

However, Lord Glennie said that where there is a risk that people's privacy rights could be infringed through the disclosure of "medical records and other sensitive documents" then they "must have the application for recovery intimated to them and must be given the opportunity to be heard in opposition to the application before an order is made or, at least, before the documents are handed over to the party seeking them".

Lord Glennie said that people's privacy rights under Article 8 of the ECHR are automatically engaged when there is a chance their medical data could be shared with third parties.

"Medical records are likely to contain highly sensitive information about an individual," he said. "Any disclosure to a third party requires to be justified."

Lord Glennie said no-one other than the person whose privacy rights are engaged, including the courts, can convey the "particular sensitivities" that need to be taken into account when determining whether disclosure of sensitive personal data is justified.

"How is the court to know whether there are any particular sensitivities to be taken into account in making its decision, unless it gets this information from the complainer or her representatives," Lord Glennie said. "It is not enough, in my opinion, and does not satisfy the requirements of Article 8, for the court to treat every case in the same way, balancing the accused’s interest in obtaining the medical records against a typical complainer’s Article 8 privacy rights. But that is what it would have to do if it did not give the complainer in every case an opportunity to be heard."

The judge said, though, that even though a person should be given a chance to air their views against non-disclosure of their sensitive data, disclosure of that information could still be justified in some cases.

"The Article 8 right to respect for private life is not, of course, unqualified," Lord Glennie said. "Disclosure can be justified in a number of circumstances, such as it being necessary in a democratic society in the interests of the prevention of crime. But it cannot be assumed that such interests will always outweigh the right to respect for privacy. Much may depend on the individual circumstances, including the seriousness of the offence and the importance and sensitivity of the records whose production is sought." 

"It may be that measures can be taken (limited disclosure, redaction, etc.) to minimise the risk of detriment to the complainer while protecting the right to a fair trial," he said.

Lord Glennie said that the right of people to be given the chance to air their views against the disclosure of their sensitive personal data does not automatically mean that legal aid should be granted in every case where that right to be heard applies.