Dr Gerard Panting answers questions on the Data Protection Act, whistleblowing and acting as a medical expert


Q Following the Soham case, and the criticism of British Gas who failed to inform social services that an elderly couple who subsequently died of hypothermia had had their supply cut off, I am confused about when information can and cannot be passed on to other authorities, particularly if there are concerns about someone’s safety.

A The Data Protection Act is a monster piece of legislation which controls both manual and computerised data relating to living individuals. Given the detail of the legislation and the technical way in which it is phrased, it is not surprising that many people are worried about getting things wrong.

However, putting the Act into practice boils down to complying with the central data protection principles which are relatively straightforward.

As far as passing information on to others is concerned, there are several data protection principles that apply.

The first is that personal data should be processed fairly and lawfully. Strictly speaking, this can only be the case if the data subject has given explicit consent to the processing of data, or if it is necessary for medical purposes and is undertaken by a health professional or someone who owes a duty of confidentiality equivalent to that health professional.

Medical purposes include preventative medicine, medical diagnosis, research, the provision of care and treatment, and the management of healthcare services.

If individual patients are considered to be at risk – and the example of patients in danger of hypothermia if they have no heating is a good one – passing information on to an appropriate authority to remove that risk clearly falls within the second category quoted above.

Perhaps a more difficult category is where there is information or simply a suspicion that an individual may be a danger to others.The problem here is that there is nothing within the data protection principles that permits public interest disclosure.

The sixth principle states that personal data should be processed in accordance with the rights of data subjects under the Act. These rights, however, are not absolute. Data subjects have a right to know what information about them is held by a data controller, the purpose for which the information may be used and who it might be disclosed to. However, that does not amount to a prohibition on disclosing information to an appropriate authority where that disclosure is necessary to protect others.

Examples of this would include reporting unfit drivers to the DVLA and notifying the police if there are grounds to believe that someone may be the perpetrator of a violent crime, particularly if there is a danger that the crime may be repeated.

In short, the Data Protection Act does not replace common sense and where something needs to be done to protect others, that action will be justified even though an express justification will be hard to find within the Data Protection Act itself.

Q A recent article in the BMJ on whistleblowing states that it is "important to contact a defence union, lawyer, or the BMA for advice. However, be prepared for the fact that they will often advise you not to take any action.1 Is this true? If so, what is the justification?

A All doctors have clear responsibilities to draw to the attention of an appropriate authority information about serious issues, whether involving patient care or any other aspect of professional behaviour.

The GMC guidance on this issue is very clear. It states:

"If you have grounds to believe that a doctor or other healthcare professional may be putting patients at risk, you must give an honest explanation of your concerns to an appropriate person from the employing authority, such as the medical director, nursing director or chief executive, or the director of public health, or an officer of your local medical committee, following any procedures set by the employer. If there are no appropriate local systems, or local systems cannot resolve the problem, and you remain concerned about the safety of patients, you should inform the relevant regulatory body. If you are not sure what to do, discuss your concerns with an impartial colleague or contact your defence body, a professional organisation or the GMC for advice.” 2

It is not up to the individual to investigate the concerns – that is the responsibility of the employer, PCO or regulatory body. However, it is definitely not correct to say that a concerned individual should not take any action. Anyone following that line may have quite a lot of explaining to do to the GMC.

Q I have been asked several times recently to provide expert advice in legal cases. Although I am quite content that I know what I am doing on the clinical front, I am concerned that I could inadvertently put my foot in it by not knowing about the law. Is this something I should be worried about?

A Medical experts are required in all manner of legal cases and although it may be different, interesting and even well remunerated, accepting instructions to be an expert may signal the beginning of a long involvement with that case, a number of meetings and sometimes a requirement to give evidence in court.

Failure to remain impartial is the first trap for the unwary. The role of the expert is essentially non-partisan. Although instructed by one side or the other, the expert’s responsibility is to the court not to the paymaster.

It is equally important to ensure that you stay within the limits of your own expertise when providing an expert report. If you are asked to provide an opinion on something where you do not have sufficient expertise, you should decline and suggest that further instructions are given to somebody else.

The third big issue for experts is the need to put up with inconvenience. Conferences with barristers and legal teams and the potential for cases to go to trial mean that experts might be required to set aside substantial amounts of time for meetings and possible court dates only to find that they are cancelled at the last moment.


  1. Coull R. Everything you always wanted to know about whistleblowing but were afraid to ask. Br Med J 2004; 328: s5-s6.
  2. General Medical Council. Good Medical Practice. London: GMC, 2001.

Guidelines in Practice, February 2004, Volume 7(2)
© 2004 MGP Ltd
further information | subscribe