This site is intended for health professionals only

At the heart of general practice since 1960

pul jul aug2020 cover 80x101px
Read the latest issue online

Independents' Day

GMC denies breaching data legislation to share personal GP information

GPs have questioned the GMC over plans to share their personal data without obtaining consent.

The GMC sent an email to over 40,000 doctors last week telling them that unless they specifically opted out, their personal data would be shared with researchers.

Imperial College London head of primary care and public health Professor Azeem Majeed, who was among GPs who recieved the email, said the method 'goes against good research practice', adding that if a doctor did this they would be 'referred to the GMC'.

Under new data protection rules all consent for sharing personal data should be opt-in. However, the GMC has maintained that it is 'fully compliant' with the rules.

In the email seen by Pulse, the GMC invited doctors working in medicine to complete a survey to support a University of Surrey research review relating to the gender pay gap.

It specifically said that unless the doctors opted out, their contact details would be shared with the researchers.

The GMC email said: ‘We're supporting this research by putting the researchers in touch with a random sample of doctors. If you would like to take part, you don't need to do anything.

‘We'll share your name, salutation and email address with the researchers, who will then send you a link to the survey…Your details will only be used for this purpose and they will be deleted afterwards.’

It added: ‘If you don't want your contact details passed to the University of Surrey please just click the "opt out" button below by the 8 November 2018 and email us your full name, postcode and GMC number.’

However, opt-out consent is not deemed acceptable under the new EU General Data Protection Regulation (GDPR) brought in earlier this year.

According to GDPR guidance published by the Information Commissioner’s Office, 'all consent must be opt-in consent', there is 'no such thing' as “opt-out consent” and 'failure to opt out is not consent'. 

'You may not rely on silence, inactivity, default settings, pre-ticked boxes or your general terms and conditions, or seek to take advantage of inertia, inattention or default bias in any other way,' the guidance adds.

Professor Majeed said: ‘This goes against good research practice and information governance whereby study participants are expected to opt in.

'As a researcher, it is not something I could do. It could result in both disciplinary action by the employer and referral to the GMC if a doctor did this.'

He added that 'doctors expect their professional regulator to behave better than this'.

But the GMC argued that the email was compliant with data protection rules, citing a section concerning 'legitimate interests'.

A spokesperson said: 'We take the processing of personal data seriously and our approach is fully compliant with the GDPR. The GDPR provides a number of conditions for the processing of personal data. Consent is often used; however, other conditions may be applicable too.

'In this instance we are processing personal data based on the legitimate interests of the University of Surrey to undertake this research. We have provided doctors with a mechanism to not participate, in the form of an opt out.'

But solicitor Toni Vitale, head of regulation, data and information at Winckworth Sherwood, said he does not agree.

He said: ‘I think that this is a genuine concern. It seems slightly odd that the GMC would choose to do this in this way.’

He continued: ‘A lot of people see legitimate interests as a silver bullet, a get out of jail free card, they can just rely on it and not have to be careful of people’s rights or interests and the data can be misused.

‘I would have thought that if they [the GMC] had properly carried out the balancing test on the researchers/GMC and the doctors, the doctors rights would have outweighed theirs.’

Readers' comments (33)

  • Serious mistake by the GMC

    Unsuitable or offensive? Report this comment

  • thank you Prof Majeed for highlighting this abhorrent practice by our regulator. Just illustrates what I thought all along: GMC do not consider Doctors rights to be as important or equal to Patient's rights.

    Unsuitable or offensive? Report this comment

  • GMC, another self serving organisation. What rights do Doctors have anymore?

    Unsuitable or offensive? Report this comment

  • Still awaiting my email?

    Unsuitable or offensive? Report this comment

  • Still waiting for my email too. Doctors have less human rights than the public is not right. The double standards persisting is shocking. Thank you Prof. Majeed for sharing this.

    Unsuitable or offensive? Report this comment

  • GMC abusing Drs right well I never!

    Unsuitable or offensive? Report this comment

  • This organisation just can't get anything right ever. Not unbelievable.
    You would have thought an awareness that their relationship with the profession wasn't exactly hunky dory would have made their behaviour squeaky clean at the moment.
    Again, extremely poor decision making and not in any way fit for purpose.

    Unsuitable or offensive? Report this comment

  • Also never got an email...?

    Unsuitable or offensive? Report this comment

  • Affected doctors should report the GMC to the Information Commissioner for breach of GDPR and let them decide if the GMC is fully compliant or not.

    Unsuitable or offensive? Report this comment

  • Neil Bhatia

    I do hope that anyone who receives such an email will complain to the ICO

    Unsuitable or offensive? Report this comment

View results 10 results per page20 results per page50 results per page

Have your say