Dear Shattered,
You are right that this is an area of law partly governed by the Data Protection Act 1998, and also by the Common Law of Confidentiality. I stress I'm not a lawyer, and in line with site rules you should regard this as comment from experience, not advice. In the NHS the consultant would have to seek advice from his NHS Trust's Information Governance Manager and possibly legal advisers and will inform the Caldicott Guardian (a senior clinician in the Trust who has undertaken specific information governance-related training and is the champion of patient confidentiality in the Trust. You say this is an independent hospital: they normally have similar arrangements although the terminology may differ, and they will possibly use a lawyer rather than an administrator as the equivalent of the Information Governance Manager. However this is a common situation, and is dealt with fairly frequently.
Overall, I'd say the Data Protection Act is on your side. But if there is what is termed a legal gateway, then disclosure could be lawful in certain circumstances. The Act works by imposing what it calls "the non-disclosure provisions" and laying down set principles, and then outlines the conditions where disclosure of information ("personal data" and "sensitive personal data") is permitted. It doesn't really create any circumstances where disclosure can be compelled by a private third party under the Data Protection Act 1998 (DPA98).
DPA98 lays down conditions for the processing of personal data and sensitive personal data (which latter term includes physical or mental health). "Processing" includes disclosure, as here. For the disclosure of personal data (as here) at least one of the conditions in Schedule 2 (not to be confused with section 2) of the Act and for sensitive personal data at least one of the conditions in Schedule 3 has to be satisfied in addition to the requirements of Schedule 2.
There is more than one provisions in Schedule 2 that might fit the bill, but two stand out. One permits disclosure where it is in the vital interests of the data subject (which is what your partner is for the purposes of the Act and this is at paragraph 4, but from what you say I doubt that would apply here (this is important as we will see later one). The most relevant condition seems to me to be that at Paragraph 6, which I reproduce in full below:
6(1): The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
This is essentially a balancing test - does your partner's daughter (the third party) have a legitimate interest in the health of her father and his prognosis and treatment? This will depend on a number of things - e.g. is she his carer? (not the case from what you say) or is there likely to be a limited time in which to say farewell, or are there things she may be required to arrange? This needs to be balanced against your partner's rights not to have the information disclosed. Given his condition, the Mental Capacity Act 2005 and the Human Rights Act 1998 may also be involved, as I will explain later on. But overall, I'd make an educated guess that the presumption would be against disclosure at all or only for a very limited level of disclosure (e.g. "your dad's dying"). While I appreciate family relationships are complex things, I would ask if you really want to prevent her knowing even that basic level of detail?
Schedule 3 has one condition that may be relevant:
8(1)The processing is necessary for medical purposes and is undertaken by—
(a)a health professional, or
(b)a person who in the circumstances owes a duty of confidentiality which is equivalent to that which would arise if that person were a health professional.
(2)In this paragraph “medical purposes” includes the purposes of preventative medicine, medical diagnosis, medical research, the provision of care and treatment and the management of healthcare services.
This would possibly allow some disclosure by the consultant (the "health professional") and the relevant condition would be that at (2) "the provision of care" (even if she is not the carer, it may be considered useful in connection with his care to some degree to give her some information). But that right is not absolute: she cannot easily compel disclosure.
Any disclosure would in any case be subject to medical confidentiality and (in the NHS) to what are called the Caldicott Principles. These will be followed in practice in the independent sector. The relevant one here is only to use the minimum information necessary, so she would have no absolute right to know everything, but it could possibly be considered lawful under both DPA98 and medical confidentiality/Caldicott Principles to disclose some limited information about his condition to her. I do not think it would be fair to try and predict the answer, but the general rule seems to be to presume not to disclose in such cases, although it will depend on individual circumstances to a degree.
But your partner has advanced dementia, and has been detained under section 3 in the past. You have Power of Attorney, so he lacks capacity. The Mental Capacity Act 2005 makes it clear at sections 1 to 5 that just because a person lacks legal capacity to make certain decisions does not mean they do not have the right to influence decisions about themselves even if these need to be communicated using other methods than the written or spoken word. Such decision must be taken in their best interests. I believe this would extend to considering previously expressed wishes. This means if it is possible for you (or, ideally a solicitor or other professional) to make some effort to ascertain your partner's current wishes, then these should be sought. I'd suggest it might be advisable if the effort should be made if possible. If you have any documentary evidence of his past wishes, or can get statements from disinterested parties who can support this view, then it might help.
Article 8 of the Human Rights Act 1998 also gives him (at Article 8(1)) a right to privacy and family life. This is partly aimed at stopping the state from interfering with correspondence or personal family decisions. But I'd suggest that it could be argued this extends to a right to have his previously-expressed wish for privacy to be upheld. However, you may not need that level of complexity.
You mention you are the holder of the Power of Attorney. You can therefore object on your partner's behalf to the proposed or potential disclosure of the information to your partner's daughter on the grounds laid down in Section 10 of DPA98. (Link here:
http://www.legislation.gov.uk/ukpga/1998/29/section/10) This is known as serving a what is called a Data Subject Notice on behalf of your partner (as the holder of a power of attorney you will almost certainly be able to do this if you hold a health and welfare attorneyship as opposed to the property and financial affairs one (many people on have the latter and they are separate and distinct). In effect, it is a kind of formalised objection process.
Section 10(1) allows the Data Subject (your partner) or a person with authority to act on his behalf (potentially you if you hold an appropriate power of attorney) to apply to the Data Controller (the Hospital) to cease, or not to begin processing (i.e. in this case disclosure to your partner's daughter) of personal data or sensitive personal data on the grounds that such processing will cause him substantial damage (unlikely - this refers to economic loss or substantial distress, and such damage or distress would be unwarranted. The reasons must be specified. Bear in mind that his condition me be relevant to the consideration of experiencing substantial distress at the disclosure. The Data Controller (the Hospital) must, under s10(3), respond within 21 days either complying or saying why they won't comply, and if only complying in part, saying to what extent they propose to comply.
Section 10(2) states that s 10(1) only applies if one of the conditions at Schedule 2, paragraphs 1 to 4 is not met - on the basis of what you say, I cannot see any of them apply, but I stress I am not in a position to offer advice on this point.
To do this I'd suggest you need to write (not email) stating that you have the power of attorney, confirm it is the relevant one, and enclose a copy of it, and that you are acting on your partner's behalf. You do not need to state that it is a Data Subject Notice under Section 10(1) of the Data Protection Act 1998. You should give enough detail to enable them to identify your partner, and explain that you wish to prevent the disclosure of any information relating to his health or prognosis to his daughter on whatever grounds you wish to state (e.g that he has expressed opposition to such disclosure in the past) and that such disclosure would cause him substantial distress. It can do know harm to remind them of the 21 day deadline. However, I must emphasise that it is by no means guaranteed that they will comply with the notice. Further guidance is at
www.ico.org.uk.
A more general letter of objection may also help, but it might be worth moving quickly if you are concerned.
I hope this is helpful.
Kind regards
Wirralson
